Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ba59fb02 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman Committed by David S. Miller
Browse files

sctp: walk the list of asoc safely 



In sctp_sendmesg(), when walking the list of endpoint associations, the
association can be dropped from the list, making the list corrupt.
Properly handle this by using list_for_each_entry_safe()

Fixes: 49102805 ("sctp: add support for snd flag SCTP_SENDALL process in sendmsg")
Reported-by: default avatarSecunia Research <vuln@secunia.com>
Tested-by: default avatarSecunia Research <vuln@secunia.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 34dbba5d

net/sctp/socket.c

+2 −2
Original line number Diff line number Diff line
@@ -2027,7 +2027,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len) 
	struct sctp_endpoint *ep = sctp_sk(sk)->ep;

	struct sctp_transport *transport = NULL;

	struct sctp_sndrcvinfo _sinfo, *sinfo;

	struct sctp_association *asoc;

	struct sctp_association *asoc, *tmp;

	struct sctp_cmsgs cmsgs;

	union sctp_addr *daddr;

	bool new = false;
@@ -2053,7 +2053,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len) 


	/* SCTP_SENDALL process */

	if ((sflags & SCTP_SENDALL) && sctp_style(sk, UDP)) {

		list_for_each_entry(asoc, &ep->asocs, asocs) {

		list_for_each_entry_safe(asoc, tmp, &ep->asocs, asocs) {

			err = sctp_sendmsg_check_sflags(asoc, sflags, msg,

							msg_len);

			if (err == 0)