From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: [PATCH net] sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer Date: Mon, 29 Oct 2018 20:51:36 -0700 (PDT) Message-ID: <20181029.205136.1748827502784008798.davem@davemloft.net> References: Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org, linux-sctp@vger.kernel.org, marcelo.leitner@gmail.com, nhorman@tuxdriver.com To: lucien.xin@gmail.com Return-path: Received: from shards.monkeyblade.net ([23.128.96.9]:45436 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725988AbeJ3MnV (ORCPT ); Tue, 30 Oct 2018 08:43:21 -0400 In-Reply-To: Sender: netdev-owner@vger.kernel.org List-ID: From: Xin Long Date: Mon, 29 Oct 2018 23:10:29 +0800 > If a transport is removed by asconf but there still are some chunks with > this transport queuing on out_chunk_list, later an use-after-free issue > will be caused when accessing this transport from these chunks in > sctp_outq_flush(). > > This is an old bug, we fix it by clearing the transport of these chunks > in out_chunk_list when removing a transport in sctp_assoc_rm_peer(). > > Reported-by: syzbot+56a40ceee5fb35932f4d@syzkaller.appspotmail.com > Signed-off-by: Xin Long Applied.