Re: [PATCH net v3] sctp: fix use-after-free of cached ASCONF chunk
| Newsgroups | org.kernel.vger.linux-sctp,org.kernel.vger.linux-kernel,org.kernel.vger.netdev,org.kernel.vger.stable |
|---|---|
| Message-ID | <178658340543.2174045.712435615952714595.git-patchwork-notify@kernel.org> |
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>: On Sun, 9 Aug 2026 12:38:06 +0800 you wrote: > addip_last_asconf caches the outstanding outbound ASCONF chunk. The normal > ASCONF-ACK completion path releases the chunk and clears the pointer. > > However, sctp_asconf_queue_teardown() releases the cached chunk without > clearing addip_last_asconf. During peer restart handling, > sctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes > sctp_asconf_queue_teardown() while the association remains alive and leaves > the pointer dangling. > > [...] Here is the summary with links: - [net,v3] sctp: fix use-after-free of cached ASCONF chunk https://git.kernel.org/netdev/net/c/8c283e7b56ad You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html