Re: KASAN: use-after-free Read in sctp_do_sm
From: Marcelo Ricardo Leitner
Date: Tue May 08 2018 - 14:57:45 EST
On Wed, May 09, 2018 at 01:41:03AM +0800, Xin Long wrote:
> > sctp_chunk_destroy net/sctp/sm_make_chunk.c:1481 [inline]
> > sctp_chunk_put+0x321/0x440 net/sctp/sm_make_chunk.c:1504
> > sctp_ulpevent_make_rcvmsg+0x955/0xd40 net/sctp/ulpevent.c:718
> There's no reason to put the chunk in sctp_ulpevent_make_rcvmsg's
> fail_mark err path before holding this chunk later there.
> We should just remove it.