[PATCH net] sctp: hold the transport before using it in sctp_hash_cmp · Xin Long <lucien.xin@gmail.com> · 2016-09-08
RE: [PATCH net] sctp: hold the transport before using it in sctp_hash_cmp · David Laight <hidden> · 2016-09-08
Re: [PATCH net] sctp: hold the transport before using it in sctp_hash_cmp · Xin Long <lucien.xin@gmail.com> · 2016-09-08
Re: [PATCH net] sctp: hold the transport before using it in sctp_hash_cmp · Neil Horman <nhorman@tuxdriver.com> · 2016-09-08
Re: [PATCH net] sctp: hold the transport before using it in sctp_hash_cmp · Xin Long <lucien.xin@gmail.com> · 2016-09-09
Re: [PATCH net] sctp: hold the transport before using it in sctp_hash_cmp · David Miller <davem@davemloft.net> · 2016-09-10
Re: [PATCH net] sctp: hold the transport before using it in sctp_hash_cmp · Xin Long <lucien.xin@gmail.com> · 2016-09-10

RE: [PATCH net] sctp: hold the transport before using it in sctp_hash_cmp

From: David Laight <hidden>
Date: 2016-09-08 12:48:27
Also in: linux-sctp

From: Xin Long

Sent: 08 September 2016 10:49
Now sctp uses the transport without holding it in sctp_hash_cmp,
it can cause a use-after-free panic. As after it get transport from
hashtable, another CPU may free it, then the members it accesses
may be unavailable memory.

How old is this bug?
Is it in any release kernels?

	David

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help