| Subject | Re: [PATCH 2.6.32 29/62] sctp: Fix race between OOTB responce and route removal | From | Ben Hutchings <> | Date | Tue, 15 Sep 2015 03:26:44 +0100 |
| |
On Sun, 2015-09-13 at 00:56 +0200, Willy Tarreau wrote: > 2.6.32-longterm review patch. If anyone has any objections, please let me know. > > ------------------ > > From: Alexander Sverdlin <alexander.sverdlin@nokia.com> > > [ Upstream commit 29c4afc4e98f4dc0ea9df22c631841f9c220b944 ] > > There is NULL pointer dereference possible during statistics update if the route > used for OOTB responce is removed at unfortunate time. If the route exists when > we receive OOTB packet and we finally jump into sctp_packet_transmit() to send > ABORT, but in the meantime route is removed under our feet, we take "no_route" > path and try to update stats with IP_INC_STATS(sock_net(asoc->base.sk), ...). [...] > [bwh: Backported to 3.2: sctp alway uses init_net] > Signed-off-by: Ben Hutchings <ben@decadent.org.uk> [...]
This doesn't make sense in 2.6.32 and it didn't make sense for me to apply it to 3.2 either! Since sctp is not using asoc to look up a net namespace here, the null pointer doesn't get dereferenced.
Ben.
|