Xin Long 8376fdc999 sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer ...

commit df132eff46 upstream.

If a transport is removed by asconf but there still are some chunks with
this transport queuing on out_chunk_list, later an use-after-free issue
will be caused when accessing this transport from these chunks in
sctp_outq_flush().

This is an old bug, we fix it by clearing the transport of these chunks
in out_chunk_list when removing a transport in sctp_assoc_rm_peer().

Reported-by: syzbot+56a40ceee5fb35932f4d@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-12-01 09:42:51 +01:00

..

associola.c

sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer

2018-12-01 09:42:51 +01:00

auth.c

sctp: remove the typedef sctp_hmac_algo_param_t

2017-07-16 20:52:14 -07:00

bind_addr.c

sctp: remove the typedef sctp_scope_t

2017-08-06 21:33:41 -07:00

chunk.c

sctp: fix erroneous inc of snmp SctpFragUsrMsgs

2018-08-24 13:09:03 +02:00

debug.c

sctp: remove the typedef sctp_subtype_t

2017-08-06 21:33:42 -07:00

endpointola.c

sctp: remove the typedef sctp_subtype_t

2017-08-06 21:33:42 -07:00

input.c

sctp: do not pr_err for the duplicated node in transport rhlist

2018-03-08 22:41:14 -08:00

inqueue.c

sctp: fix the issue that the cookie-ack with auth can't get processed

2018-05-19 10:20:25 +02:00

ipv6.c

sctp: handle two v4 addrs comparison in sctp_inet6_cmp_addr

2018-05-19 10:20:25 +02:00

Kconfig

sctp: add the sctp_diag.c file

2016-04-15 17:29:36 -04:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

objcnt.c

sctp: remove the typedef sctp_dbg_objcnt_entry_t

2017-08-11 10:02:43 -07:00

offload.c

gso: validate gso_type in GSO handlers

2018-01-31 14:03:47 +01:00

output.c

sctp: remove the typedef sctp_xmit_t

2017-08-06 21:33:42 -07:00

outqueue.c

sctp: only update outstanding_bytes for transmitted queue when doing prsctp_prune

2018-02-25 11:07:57 +01:00

primitive.c

sctp: remove the typedef sctp_subtype_t

2017-08-06 21:33:42 -07:00

probe.c

sctp: remove the typedef sctp_disposition_t

2017-08-11 10:02:44 -07:00

proc.c

sctp: hold transport before accessing its asoc in sctp_transport_get_next

2018-09-15 09:45:25 +02:00

protocol.c

sctp: fix dst refcnt leak in sctp_v4_get_dst

2018-03-08 22:41:11 -08:00

sctp_diag.c

sctp: Fix a big endian bug in sctp_diag_dump()

2017-09-26 21:16:29 -07:00

sm_make_chunk.c

sctp: verify size of a new chunk in _sctp_make_chunk()

2018-03-08 22:41:10 -08:00

sm_sideeffect.c

sctp: fix some type cast warnings introduced since very beginning

2017-10-29 18:03:24 +09:00

sm_statefuns.c

sctp: use the old asoc when making the cookie-ack chunk in dupcook_d

2018-05-19 10:20:25 +02:00

sm_statetable.c

sctp: remove the typedef sctp_sm_table_entry_t

2017-08-11 10:02:44 -07:00

socket.c

sctp: not allow to set asoc prsctp_enable by sockopt

2018-11-23 08:19:26 +01:00

stream.c

sctp: not increase stream's incnt before sending addstrm_in request

2018-11-23 08:19:26 +01:00

sysctl.c

sctp: remove the typedef sctp_scope_policy_t

2017-08-06 21:33:41 -07:00

transport.c

sctp: update dst pmtu with the correct daddr

2018-10-18 09:16:19 +02:00

tsnmap.c

sctp: Fix FSF address in file headers

2013-12-06 12:37:56 -05:00

ulpevent.c

sctp: remove sctp_chunk_put from fail_mark err path in sctp_ulpevent_make_rcvmsg

2018-05-19 10:20:25 +02:00

ulpqueue.c

sctp: fix the issue that a __u16 variable may overflow in sctp_ulpq_renege

2018-03-03 10:24:24 +01:00