From: Greg KH on
2.6.33-stable review patch. If anyone has any objections, please let us know.


From: Vlad Yasevich <vladislav.yasevich(a)>

[ Upstream commit 0c42749cffbb4a06be86c5e5db6c7ebad548781f ]

When sctp attempts to update an assocition, it removes any
addresses that were not in the updated INITs. However, the loop
may attempt to refrence a transport with address after removing it.

Signed-off-by: Vlad Yasevich <vladislav.yasevich(a)>
Signed-off-by: David S. Miller <davem(a)>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)>
net/sctp/associola.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1194,8 +1194,10 @@ void sctp_assoc_update(struct sctp_assoc
/* Remove any peer addresses not present in the new association. */
list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
trans = list_entry(pos, struct sctp_transport, transports);
- if (!sctp_assoc_lookup_paddr(new, &trans->ipaddr))
- sctp_assoc_del_peer(asoc, &trans->ipaddr);
+ if (!sctp_assoc_lookup_paddr(new, &trans->ipaddr)) {
+ sctp_assoc_rm_peer(asoc, trans);
+ continue;
+ }

if (asoc->state >= SCTP_STATE_ESTABLISHED)

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)
More majordomo info at
Please read the FAQ at