Commit e044554e authored by Xin Long's avatar Xin Long Committed by Greg Kroah-Hartman

sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer

commit df132eff463873e14e019a07f387b4d577d6d1f9 upstream.

If a transport is removed by asconf but there still are some chunks with
this transport queuing on out_chunk_list, later an use-after-free issue
will be caused when accessing this transport from these chunks in

This is an old bug, we fix it by clearing the transport of these chunks
in out_chunk_list when removing a transport in sctp_assoc_rm_peer().

Signed-off-by: default avatarXin Long <>
Signed-off-by: default avatarDavid S. Miller <>
Signed-off-by: default avatarGreg Kroah-Hartman <>
parent ecfcb85c
......@@ -488,8 +488,9 @@ void sctp_assoc_set_primary(struct sctp_association *asoc,
void sctp_assoc_rm_peer(struct sctp_association *asoc,
struct sctp_transport *peer)
struct list_head *pos;
struct sctp_transport *transport;
struct sctp_transport *transport;
struct list_head *pos;
struct sctp_chunk *ch;
pr_debug("%s: association:%p addr:%pISpc\n",
__func__, asoc, &peer->;
......@@ -547,7 +548,6 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc,
if (!list_empty(&peer->transmitted)) {
struct sctp_transport *active = asoc->peer.active_path;
struct sctp_chunk *ch;
/* Reset the transport of each chunk on this list */
list_for_each_entry(ch, &peer->transmitted,
......@@ -569,6 +569,10 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc,
list_for_each_entry(ch, &asoc->outqueue.out_chunk_list, list)
if (ch->transport == peer)
ch->transport = NULL;
Markdown is supported
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment