Commit f53d77e1 authored Jan 23, 2018 by Xin Long Committed by David S. Miller Jan 23, 2018

sctp: reset ret in again path in sctp_for_each_transport



Commit 97a6ec4a ("rhashtable: Change rhashtable_walk_start to
return void") only initialized ret for the first time, when going
to again path, the next tsp could be NULL. Without resetting ret,
cb_done would be called with tsp as NULL.

A kernel crash was caused by this when running sctpdiag testcase
in sctp-tests.

Note that this issue doesn't affect net.git yet.

Fixes: 97a6ec4a ("rhashtable: Change rhashtable_walk_start to return void")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 196709f4

net/sctp/socket.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -4860,9 +4860,10 @@ int sctp_for_each_transport(int (cb)(struct sctp_transport , void *),
		struct net net, int pos, void *p) {
		struct rhashtable_iter hti;
		struct sctp_transport *tsp;
		int ret = 0;
		int ret;

		again:
		ret = 0;
		sctp_transport_walk_start(&hti);

		tsp = sctp_transport_get_idx(net, &hti, *pos + 1);