This is a note to let you know that I've just added the patch titled sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: sctp-clear-the-transport-of-some-out_chunk_list-chunks-in-sctp_assoc_rm_peer.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From df132eff463873e14e019a07f387b4d577d6d1f9 Mon Sep 17 00:00:00 2001 From: Xin Long <lucien.xin@xxxxxxxxx> Date: Mon, 29 Oct 2018 23:10:29 +0800 Subject: sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer From: Xin Long <lucien.xin@xxxxxxxxx> commit df132eff463873e14e019a07f387b4d577d6d1f9 upstream. If a transport is removed by asconf but there still are some chunks with this transport queuing on out_chunk_list, later an use-after-free issue will be caused when accessing this transport from these chunks in sctp_outq_flush(). This is an old bug, we fix it by clearing the transport of these chunks in out_chunk_list when removing a transport in sctp_assoc_rm_peer(). Reported-by: syzbot+56a40ceee5fb35932f4d@xxxxxxxxxxxxxxxxxxxxxxxxx Signed-off-by: Xin Long <lucien.xin@xxxxxxxxx> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/sctp/associola.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) --- a/net/sctp/associola.c +++ b/net/sctp/associola.c @@ -488,8 +488,9 @@ void sctp_assoc_set_primary(struct sctp_ void sctp_assoc_rm_peer(struct sctp_association *asoc, struct sctp_transport *peer) { - struct list_head *pos; - struct sctp_transport *transport; + struct sctp_transport *transport; + struct list_head *pos; + struct sctp_chunk *ch; pr_debug("%s: association:%p addr:%pISpc\n", __func__, asoc, &peer->ipaddr.sa); @@ -547,7 +548,6 @@ void sctp_assoc_rm_peer(struct sctp_asso */ if (!list_empty(&peer->transmitted)) { struct sctp_transport *active = asoc->peer.active_path; - struct sctp_chunk *ch; /* Reset the transport of each chunk on this list */ list_for_each_entry(ch, &peer->transmitted, @@ -569,6 +569,10 @@ void sctp_assoc_rm_peer(struct sctp_asso sctp_transport_hold(active); } + list_for_each_entry(ch, &asoc->outqueue.out_chunk_list, list) + if (ch->transport == peer) + ch->transport = NULL; + asoc->peer.transport_count--; sctp_transport_free(peer); Patches currently in stable-queue which might be from lucien.xin@xxxxxxxxx are queue-4.9/sctp-clear-the-transport-of-some-out_chunk_list-chunks-in-sctp_assoc_rm_peer.patch