]>
Commit | Line | Data |
---|---|---|
fa55523a GKH |
1 | From foo@baz Thu Dec 14 11:45:40 CET 2017 |
2 | From: Xin Long <lucien.xin@gmail.com> | |
3 | Date: Sun, 26 Nov 2017 20:56:07 +0800 | |
4 | Subject: sctp: use right member as the param of list_for_each_entry | |
5 | ||
6 | From: Xin Long <lucien.xin@gmail.com> | |
7 | ||
8 | ||
9 | [ Upstream commit a8dd397903a6e57157f6265911f7d35681364427 ] | |
10 | ||
11 | Commit d04adf1b3551 ("sctp: reset owner sk for data chunks on out queues | |
12 | when migrating a sock") made a mistake that using 'list' as the param of | |
13 | list_for_each_entry to traverse the retransmit, sacked and abandoned | |
14 | queues, while chunks are using 'transmitted_list' to link into these | |
15 | queues. | |
16 | ||
17 | It could cause NULL dereference panic if there are chunks in any of these | |
18 | queues when peeling off one asoc. | |
19 | ||
20 | So use the chunk member 'transmitted_list' instead in this patch. | |
21 | ||
22 | Fixes: d04adf1b3551 ("sctp: reset owner sk for data chunks on out queues when migrating a sock") | |
23 | Signed-off-by: Xin Long <lucien.xin@gmail.com> | |
24 | Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> | |
25 | Acked-by: Neil Horman <nhorman@tuxdriver.com> | |
26 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
27 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
28 | --- | |
29 | net/sctp/socket.c | 6 +++--- | |
30 | 1 file changed, 3 insertions(+), 3 deletions(-) | |
31 | ||
32 | --- a/net/sctp/socket.c | |
33 | +++ b/net/sctp/socket.c | |
34 | @@ -187,13 +187,13 @@ static void sctp_for_each_tx_datachunk(s | |
35 | list_for_each_entry(chunk, &t->transmitted, transmitted_list) | |
36 | cb(chunk); | |
37 | ||
38 | - list_for_each_entry(chunk, &q->retransmit, list) | |
39 | + list_for_each_entry(chunk, &q->retransmit, transmitted_list) | |
40 | cb(chunk); | |
41 | ||
42 | - list_for_each_entry(chunk, &q->sacked, list) | |
43 | + list_for_each_entry(chunk, &q->sacked, transmitted_list) | |
44 | cb(chunk); | |
45 | ||
46 | - list_for_each_entry(chunk, &q->abandoned, list) | |
47 | + list_for_each_entry(chunk, &q->abandoned, transmitted_list) | |
48 | cb(chunk); | |
49 | ||
50 | list_for_each_entry(chunk, &q->out_chunk_list, list) |