Subject: Re: [PATCH] net: SCTP NULL-pointer dereference problem description and fix

From: Vlad Yasevich <[email-masked]>
Date: Wed, 15 Sep 2010 09:02:56 -0400

On 09/15/2010 08:53 AM, Thomas Dreibholz wrote:
> On Mittwoch 15 September 2010, Shan Wei wrote:
>> Thomas Dreibholz wrote, at 09/15/2010 04:03 PM:
>>> sctp_assoc_update_retran_path() in net/sctp/associola.c may dereference a
>>> NULL-pointer when compiled with SCTP_DEBUG option: t will be NULL if
>>> there is no usable path for retransmission. SCTP_DEBUG_PRINTK_IPADDR()
>>> makes an access to t->ipaddr.v4.sin_port, without checking t before.
>>> t==NULL => oops.
>>>
>>> The patch below against 2.6.36-rc4 (git repository) simply ensures that t
>>> is checked for not being set to NULL before calling
>>> SCTP_DEBUG_PRINTK_IPADDR().
>>
>> This bug has been reported by WeiYongjun and fixed by vlad for several
>> months. About the details see .
>> http://marc.info/?l=linux-sctp&m=127359276009851&w=2
>>
>> But this patch is still in vlad's net-next tree, not in main tree.
>> See the patch:
>> http://git.kernel.org/?p=linux/kernel/git/vxy/lksctp-dev.git;a=commit;h=eb1
>> 639d206320e6a09168d6dd77306eaf5f02582
> 
> This patch resolves the problem. I am using the main tree. The patch should 
> also be applied there.
> 
> 
> Best regards

Yes.  I know.  I've been just touch busy (and not with SCTP pieces) and backlog
is starting to accumulate.
I'll try to push stuff out this week.

-vlad