From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from wtarreau.pck.nerim.net ([62.212.114.60]:12932 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751531AbbIOHnY (ORCPT ); Tue, 15 Sep 2015 03:43:24 -0400 Date: Tue, 15 Sep 2015 09:43:05 +0200 From: Willy Tarreau To: Ben Hutchings Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org, Alexander Sverdlin , Neil Horman , Marcelo Ricardo Leitner , Vlad Yasevich , "David S. Miller" Subject: Re: [PATCH 2.6.32 29/62] sctp: Fix race between OOTB responce and route removal Message-ID: <20150915074305.GC29318@1wt.eu> References: <20150912225607.810043732@1wt.eu> <1442284004.29883.4.camel@decadent.org.uk> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1442284004.29883.4.camel@decadent.org.uk> Sender: stable-owner@vger.kernel.org List-ID: On Tue, Sep 15, 2015 at 03:26:44AM +0100, Ben Hutchings wrote: > On Sun, 2015-09-13 at 00:56 +0200, Willy Tarreau wrote: > > 2.6.32-longterm review patch. If anyone has any objections, please let me know. > > > > ------------------ > > > > From: Alexander Sverdlin > > > > [ Upstream commit 29c4afc4e98f4dc0ea9df22c631841f9c220b944 ] > > > > There is NULL pointer dereference possible during statistics update if the route > > used for OOTB responce is removed at unfortunate time. If the route exists when > > we receive OOTB packet and we finally jump into sctp_packet_transmit() to send > > ABORT, but in the meantime route is removed under our feet, we take "no_route" > > path and try to update stats with IP_INC_STATS(sock_net(asoc->base.sk), ...). > [...] > > [bwh: Backported to 3.2: sctp alway uses init_net] > > Signed-off-by: Ben Hutchings > [...] > > This doesn't make sense in 2.6.32 and it didn't make sense for me to > apply it to 3.2 either! Since sctp is not using asoc to look up a net > namespace here, the null pointer doesn't get dereferenced. Perfect, I'm dropping it now. Thanks, Willy