diff options
| author | Xin Long <lucien.xin@gmail.com> | 2018-01-23 18:22:25 +0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-01-23 11:22:25 -0500 |
| commit | f53d77e19b6587527a3dd60a0e638f115e5cd7a9 (patch) | |
| tree | aaf4ecd21339dcd54865856a95649b2c9739bcb5 /net | |
| parent | 196709f4942dfc70e11088a025f3e14305117393 (diff) | |
sctp: reset ret in again path in sctp_for_each_transport
Commit 97a6ec4ac021 ("rhashtable: Change rhashtable_walk_start to
return void") only initialized ret for the first time, when going
to again path, the next tsp could be NULL. Without resetting ret,
cb_done would be called with tsp as NULL.
A kernel crash was caused by this when running sctpdiag testcase
in sctp-tests.
Note that this issue doesn't affect net.git yet.
Fixes: 97a6ec4ac021 ("rhashtable: Change rhashtable_walk_start to return void")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sctp/socket.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 7ff444ecee75..a40fa53c93ef 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -4860,9 +4860,10 @@ int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *), struct net *net, int *pos, void *p) { struct rhashtable_iter hti; struct sctp_transport *tsp; - int ret = 0; + int ret; again: + ret = 0; sctp_transport_walk_start(&hti); tsp = sctp_transport_get_idx(net, &hti, *pos + 1); |