Skip to main content

Browse the archive

https://github.com/torvalds/linux
13 June 2022, 11:31:42 UTC
Revision 771085d6bf3c52de29fc213e5bad07a82e57c23e authored by Daniel Borkmann on 09 August 2013, 14:25:21 UTC, committed by David S. Miller on 13 August 2013, 05:13:47 UTC 
net: sctp: sctp_transport_destroy{, _rcu}: fix potential pointer corruption
 
Probably this one is quite unlikely to be triggered, but it's more safe
to do the call_rcu() at the end after we have dropped the reference on
the asoc and freed sctp packet chunks. The reason why is because in
sctp_transport_destroy_rcu() the transport is being kfree()'d, and if
we're unlucky enough we could run into corrupted pointers. Probably
that's more of theoretical nature, but it's safer to have this simple fix.

Introduced by commit 8c98653f ("sctp: sctp_close: fix release of bindings
for deferred call_rcu's"). I also did the 8c98653f regression test and
it's fine that way.

Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent ac4f959
History
Tip revision: 771085d6bf3c52de29fc213e5bad07a82e57c23e authored by Daniel Borkmann on 09 August 2013, 14:25:21 UTC
net: sctp: sctp_transport_destroy{, _rcu}: fix potential pointer corruption
Tip revision: 771085d
File Mode Size
Documentation
arch
block
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.gitignore -rw-r--r-- 1.1 KB
.mailmap -rw-r--r-- 4.4 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 93.1 KB
Kbuild -rw-r--r-- 2.5 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 253.7 KB
Makefile -rw-r--r-- 47.4 KB
README -rw-r--r-- 18.3 KB
REPORTING-BUGS -rw-r--r-- 7.3 KB

README

back to top