Marcelo Ricardo Leitner 79d0895140 sctp: fix error path in sctp_stream_init ... syzbot noticed a NULL pointer dereference panic in sctp_stream_free() which was caused by an incomplete error handling in sctp_stream_init(). By not clearing stream->outcnt, it made a for() in sctp_stream_free() think that it had elements to free, but not, leading to the panic. As suggested by Xin Long, this patch also simplifies the error path by moving it to the only if() that uses it. See-also: https://www.spinics.net/lists/netdev/msg473756.html See-also: https://www.spinics.net/lists/netdev/msg465024.html Reported-by: syzbot <syzkaller@googlegroups.com> Fixes: f952be79ce ("sctp: introduce struct sctp_stream_out_ext") Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Reviewed-by: Xin Long <lucien.xin@gmail.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-01-03 11:29:42 -05:00
..
6lowpan	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
9p	make sock_alloc_file() do sock_release() on failures	2017-12-05 18:39:29 -05:00
802	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
8021q	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-12 09:17:05 +09:00
appletalk	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
atm	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
ax25	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
batman-adv	batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq	2017-12-04 11:47:33 +01:00
bluetooth	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
bpf	bpf: add meta pointer for direct access	2017-09-26 13:36:44 -07:00
bridge	net: bridge: fix early call to br_stp_change_bridge_id and plug newlink leaks	2017-12-18 13:29:01 -05:00
caif	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
can	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
ceph	We have a set of file locking improvements from Zheng, rbd rw/ro	2017-11-21 05:38:32 -10:00
core	ethtool: do not print warning for applications using legacy API	2018-01-02 21:49:17 -05:00
dcb	rtnetlink: make rtnl_register accept a flags parameter	2017-08-09 16:57:38 -07:00
dccp	dccp: CVE-2017-8824: use-after-free in DCCP code	2017-12-05 18:08:53 -05:00
decnet	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
dns_resolver	KEYS: Fix race between updating and finding a negative key	2017-10-18 09:12:40 +01:00
dsa	net: remove duplicate includes	2017-12-13 13:18:46 -05:00
ethernet	networking: make skb_push & __skb_push return void pointers	2017-06-16 11:48:40 -04:00
hsr	net: hsr: Convert timers to use timer_setup()	2017-10-25 13:00:27 +09:00
ieee802154	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
ife	MAINTAINERS: Update Yotam's E-mail	2017-11-01 12:19:03 +09:00
ipv4	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec	2017-12-27 10:58:23 -05:00
ipv6	ip6_tunnel: allow ip6gre dev mtu to be set below 1280	2018-01-02 12:36:14 -05:00
ipx	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
iucv	iucv: Convert sk_wmem_alloc accesses to refcount_t.	2017-07-03 02:31:22 -07:00
kcm	make sock_alloc_file() do sock_release() on failures	2017-12-05 18:39:29 -05:00
key	af_key: replace BUG_ON on WARN_ON in net_exit hook	2017-11-14 15:45:52 +09:00
l2tp	l2tp: exit_net cleanup check added	2017-11-14 15:45:53 +09:00
l3mdev	…
lapb	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
llc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-11-15 11:56:19 -08:00
mac80211	mac80211: fix locking in ieee80211_sta_tear_down_BA_sessions	2017-12-11 10:50:00 +01:00
mac802154	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
mpls	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
ncsi	treewide: setup_timer() -> timer_setup() (2 field)	2017-11-21 15:57:09 -08:00
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2017-12-13 14:12:20 -05:00
netlabel	net/netlabel: Add list_next_rcu() in rcu_dereference().	2017-11-18 10:32:41 +09:00
netlink	netlink: Add netns check on taps	2017-12-11 11:58:18 -05:00
netrom	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
nfc	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
nsh	openvswitch: enable NSH support	2017-11-08 16:12:33 +09:00
openvswitch	openvswitch: Fix pop_vlan action for double tagged frames	2017-12-21 13:02:08 -05:00
packet	net/packet: fix a race in packet_bind() and packet_notifier()	2017-11-28 11:13:30 -05:00
phonet	phonet: exit_net cleanup check added	2017-11-14 15:45:53 +09:00
psample	MAINTAINERS: Update Yotam's E-mail	2017-11-01 12:19:03 +09:00
qrtr	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-10 10:00:18 +09:00
rds	RDS: Heap OOB write in rds_message_alloc_sgs()	2018-01-03 11:23:05 -05:00
rfkill	net: rfkill: gpio: Switch to devm_acpi_dev_add_driver_gpios()	2017-06-13 11:07:51 +02:00
rose	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
rxrpc	rxrpc: Use correct netns source in rxrpc_release_sock()	2017-12-03 10:05:20 -05:00
sched	net/sched: Fix update of lastuse in act modules implementing stats_update	2018-01-02 13:27:52 -05:00
sctp	sctp: fix error path in sctp_stream_init	2018-01-03 11:29:42 -05:00
smc	net/smc: Fix preinitialization of buf_desc in __smc_buf_create()	2017-11-24 01:33:34 +09:00
strparser	strparser: Call sock_owned_by_user_nocheck	2017-12-28 14:28:22 -05:00
sunrpc	NFS client fixes for Linux 4.15-rc4	2017-12-16 13:12:53 -08:00
switchdev	net: bridge: Add/del switchdev object on host join/leave	2017-11-10 13:41:40 +09:00
tipc	tipc: fix problems with multipoint-to-point flow control	2018-01-02 21:52:07 -05:00
tls	tls: don't override sk_write_space if tls_set_sw_offload fails.	2017-11-14 16:26:35 +09:00
unix	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
vmw_vsock	VSOCK: fix outdated sk_state value in hvs_release()	2017-12-05 15:07:37 -05:00
wimax	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
wireless	cfg80211: ship certificates as hex files	2017-12-19 09:28:01 +01:00
x25	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
xfrm	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec	2017-12-27 10:58:23 -05:00
Kconfig	net: Remove CONFIG_NETFILTER_DEBUG and _ASSERT() macros.	2017-09-04 13:25:20 +02:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
compat.c	net: compat: assert the size of cmsg copied in is as expected	2017-09-20 15:36:18 -07:00
socket.c	make sock_alloc_file() do sock_release() on failures	2017-12-05 18:39:29 -05:00
sysctl_net.c	…