Re: [PATCH net] sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer

2018-10-29 Thread David Miller
From: Xin Long Date: Mon, 29 Oct 2018 23:10:29 +0800 > If a transport is removed by asconf but there still are some chunks with > this transport queuing on out_chunk_list, later an use-after-free issue > will be caused when accessing this transport from these chunks in > sctp_outq_flush(). > >

[PATCH net] sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer

2018-10-29 Thread Xin Long
If a transport is removed by asconf but there still are some chunks with this transport queuing on out_chunk_list, later an use-after-free issue will be caused when accessing this transport from these chunks in sctp_outq_flush(). This is an old bug, we fix it by clearing the transport of these