Xin Long df132eff46 sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer ...

If a transport is removed by asconf but there still are some chunks with
this transport queuing on out_chunk_list, later an use-after-free issue
will be caused when accessing this transport from these chunks in
sctp_outq_flush().

This is an old bug, we fix it by clearing the transport of these chunks
in out_chunk_list when removing a transport in sctp_assoc_rm_peer().

Reported-by: syzbot+56a40ceee5fb35932f4d@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2018-10-29 20:49:44 -07:00

..

associola.c

sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer

2018-10-29 20:49:44 -07:00

auth.c

treewide: kzalloc() -> kcalloc()

2018-06-12 16:19:22 -07:00

bind_addr.c

sctp: remove the typedef sctp_scope_t

2017-08-06 21:33:41 -07:00

chunk.c

net/sctp: Make wrappers for accessing in/out streams

2018-08-11 12:25:15 -07:00

debug.c

sctp: add SCTP_CID_I_DATA and SCTP_CID_I_FWD_TSN conversion in sctp_cname

2018-02-12 11:40:01 -05:00

diag.c

sctp: add file comments in diag.c

2018-02-13 13:56:31 -05:00

endpointola.c

treewide: Use struct_size() for kmalloc()-family

2018-06-06 11:15:43 -07:00

input.c

sctp: use the pmtu from the icmp packet to update transport pathmtu

2018-10-15 22:54:20 -07:00

inqueue.c

sctp: fix the issue that the cookie-ack with auth can't get processed

2018-05-02 11:15:33 -04:00

ipv6.c

sctp: check for ipv6_pinfo legal sndflow with flowlabel in sctp_v6_get_dst

2018-07-04 11:36:54 +09:00

Kconfig

sctp: whitespace fixes

2018-07-24 14:10:42 -07:00

Makefile

sctp: rename sctp_diag.c as diag.c

2018-02-13 13:56:31 -05:00

objcnt.c

proc: introduce proc_create_seq{,_data}

2018-05-16 07:23:35 +02:00

offload.c

net: use skb_is_gso_sctp() instead of open-coding

2018-03-09 11:41:47 -05:00

output.c

sctp: use the pmtu from the icmp packet to update transport pathmtu

2018-10-15 22:54:20 -07:00

outqueue.c

sctp: count both sk and asoc sndbuf with skb truesize and sctp_chunk size

2018-10-18 11:23:47 -07:00

primitive.c

sctp: remove the typedef sctp_subtype_t

2017-08-06 21:33:42 -07:00

proc.c

sctp: remove useless start_fail from sctp_ht_iter in proc

2018-08-27 15:13:17 -07:00

protocol.c

sctp: add support for dscp and flowlabel per transport

2018-07-04 11:36:54 +09:00

sm_make_chunk.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2018-05-11 20:53:22 -04:00

sm_sideeffect.c

sctp: whitespace fixes

2018-07-24 14:10:42 -07:00

sm_statefuns.c

sctp: delay the authentication for the duplicated cookie-echo chunk

2018-05-07 23:39:10 -04:00

sm_statetable.c

sctp: implement validate_ftsn for sctp_stream_interleave

2017-12-15 13:52:22 -05:00

socket.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2018-10-19 11:03:06 -07:00

stream_interleave.c

net/sctp: Make wrappers for accessing in/out streams

2018-08-11 12:25:15 -07:00

stream_sched_prio.c

net/sctp: Make wrappers for accessing in/out streams

2018-08-11 12:25:15 -07:00

stream_sched_rr.c

net/sctp: Make wrappers for accessing in/out streams

2018-08-11 12:25:15 -07:00

stream_sched.c

net/sctp: Make wrappers for accessing in/out streams

2018-08-11 12:25:15 -07:00

stream.c

net/sctp: Replace in/out stream arrays with flex_array

2018-08-11 12:25:15 -07:00

sysctl.c

sctp: support sysctl to allow users to use stream interleave

2017-12-15 13:52:22 -05:00

transport.c

sctp: update dst pmtu with the correct daddr

2018-09-20 11:29:30 -07:00

tsnmap.c

sctp: Fix FSF address in file headers

2013-12-06 12:37:56 -05:00

ulpevent.c

sctp: remove sctp_chunk_put from fail_mark err path in sctp_ulpevent_make_rcvmsg

2018-05-10 17:48:36 -04:00

ulpqueue.c

sctp: Use skb_queue_is_first().

2018-09-10 10:06:53 -07:00