| From 8cc68b8205d9e0c543d29cf662dfc012c2b4637f Mon Sep 17 00:00:00 2001 |
| From: Vlad Yasevich <vladislav.yasevich@hp.com> |
| Date: Wed, 28 Apr 2010 08:47:19 +0000 |
| Subject: sctp: fix potential reference of a freed pointer |
| |
| |
| From: Vlad Yasevich <vladislav.yasevich@hp.com> |
| |
| [ Upstream commit 0c42749cffbb4a06be86c5e5db6c7ebad548781f ] |
| |
| When sctp attempts to update an assocition, it removes any |
| addresses that were not in the updated INITs. However, the loop |
| may attempt to refrence a transport with address after removing it. |
| |
| Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| --- |
| net/sctp/associola.c | 6 ++++-- |
| 1 file changed, 4 insertions(+), 2 deletions(-) |
| |
| --- a/net/sctp/associola.c |
| +++ b/net/sctp/associola.c |
| @@ -1194,8 +1194,10 @@ void sctp_assoc_update(struct sctp_assoc |
| /* Remove any peer addresses not present in the new association. */ |
| list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) { |
| trans = list_entry(pos, struct sctp_transport, transports); |
| - if (!sctp_assoc_lookup_paddr(new, &trans->ipaddr)) |
| - sctp_assoc_del_peer(asoc, &trans->ipaddr); |
| + if (!sctp_assoc_lookup_paddr(new, &trans->ipaddr)) { |
| + sctp_assoc_rm_peer(asoc, trans); |
| + continue; |
| + } |
| |
| if (asoc->state >= SCTP_STATE_ESTABLISHED) |
| sctp_transport_reset(trans); |
