In sctp_hash_transport, it dereferences a transport's asoc only under rcu_read_lock. Without holding the transport, its asoc could be freed already, which leads to a use-after-free panic. A similar fix as Commit bab1be79a516 ("sctp: hold transport before accessing its asoc in sctp_transport_get_next") is needed to hold the transport before accessing its asoc in sctp_hash_transport. Fixes: cd2b70875058 ("sctp: check duplicate node before inserting a new transport") Reported-by: syzbot+0b05d8aa7cb185107483@xxxxxxxxxxxxxxxxxxxxxxxxx Signed-off-by: Xin Long <lucien.xin@xxxxxxxxx> --- net/sctp/input.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/sctp/input.c b/net/sctp/input.c index 5c36a99..69584e9 100644 --- a/net/sctp/input.c +++ b/net/sctp/input.c @@ -896,11 +896,16 @@ int sctp_hash_transport(struct sctp_transport *t) list = rhltable_lookup(&sctp_transport_hashtable, &arg, sctp_hash_params); - rhl_for_each_entry_rcu(transport, tmp, list, node) + rhl_for_each_entry_rcu(transport, tmp, list, node) { + if (!sctp_transport_hold(transport)) + continue; if (transport->asoc->ep == t->asoc->ep) { + sctp_transport_put(transport); rcu_read_unlock(); return -EEXIST; } + sctp_transport_put(transport); + } rcu_read_unlock(); err = rhltable_insert_key(&sctp_transport_hashtable, &arg, -- 2.1.0