iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'sctp-fix-a-null-pointer-dereference-in-sctp_sched_dequeue_common'

Browse Source 
Xin Long says:

====================
sctp: fix a NULL pointer dereference in sctp_sched_dequeue_common

This issue was triggered with SCTP_PR_SCTP_PRIO in sctp,
and caused by not checking and fixing stream->out_curr
after removing a chunk from this stream.

Patch 1 removes an unnecessary check and makes the real
fix easier to add in Patch 2.
====================

Link: https://lore.kernel.org/r/cover.1667598261.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski 2022-11-07 19:59:05 -08:00
commit 89bbe785b4
1 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
net/sctp/outqueue.c
View File

@ -384,6 +384,7 @@ static int sctp_prsctp_prune_unsent(struct sctp_association *asoc,
{
struct sctp_outq *q = &asoc->outqueue;
struct sctp_chunk *chk, *temp;
struct sctp_stream_out *sout;
q->sched->unsched_all(&asoc->stream);
@ -398,12 +399,14 @@ static int sctp_prsctp_prune_unsent(struct sctp_association *asoc,
sctp_sched_dequeue_common(q, chk);
asoc->sent_cnt_removable--;
asoc->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++;
if (chk->sinfo.sinfo_stream < asoc->stream.outcnt) {
struct sctp_stream_out *streamout =
SCTP_SO(&asoc->stream, chk->sinfo.sinfo_stream);
streamout->ext->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++;
}
sout = SCTP_SO(&asoc->stream, chk->sinfo.sinfo_stream);
sout->ext->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++;
/* clear out_curr if all frag chunks are pruned */
if (asoc->stream.out_curr == sout &&
list_is_last(&chk->frag_list, &chk->msg->chunks))
asoc->stream.out_curr = NULL;
msg_len -= chk->skb->truesize + sizeof(struct sctp_chunk);
sctp_chunk_free(chk);