From: Xin Long <lucien....@gmail.com> Date: Mon, 27 Aug 2018 18:38:31 +0800
> As Marcelo noticed, in sctp_transport_get_next, it is iterating over > transports but then also accessing the association directly, without > checking any refcnts before that, which can cause an use-after-free > Read. > > So fix it by holding transport before accessing the association. With > that, sctp_transport_hold calls can be removed in the later places. > > Fixes: 626d16f50f39 ("sctp: export some apis or variables for sctp_diag and > reuse some for proc") > Reported-by: syzbot+fe62a0c9aa6a85c6d...@syzkaller.appspotmail.com > Signed-off-by: Xin Long <lucien....@gmail.com> Applied and queued up for -stable.