Patch "sctp: sctp_transport_lookup_process should rcu_read_unlock when transport is null" has been added to the 4.9-stable tree

Patch "sctp: sctp_transport_lookup_process should rcu_read_unlock when transport is null" has been added to the 4.9-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    sctp: sctp_transport_lookup_process should rcu_read_unlock when transport is null

to the 4.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     sctp-sctp_transport_lookup_process-should-rcu_read_unlock-when-transport-is-null.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From foo@baz Thu Jan 12 21:37:26 CET 2017
From: Xin Long <lucien.xin@gmail.com>
Date: Thu, 15 Dec 2016 23:05:52 +0800
Subject: sctp: sctp_transport_lookup_process should rcu_read_unlock when transport is null

From: Xin Long <lucien.xin@gmail.com>


[ Upstream commit 08abb79542c9e8c367d1d8e44fe1026868d3f0a7 ]

Prior to this patch, sctp_transport_lookup_process didn't rcu_read_unlock
when it failed to find a transport by sctp_addrs_lookup_transport.

This patch is to fix it by moving up rcu_read_unlock right before checking
transport and also to remove the out path.

Fixes: 1cceda784980 ("sctp: fix the issue sctp_diag uses lock_sock in rcu_read_lock")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/socket.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4479,9 +4479,10 @@ int sctp_transport_lookup_process(int (*
 
 	rcu_read_lock();
 	transport = sctp_addrs_lookup_transport(net, laddr, paddr);
-	if (!transport || !sctp_transport_hold(transport))
+	if (!transport || !sctp_transport_hold(transport)) {
+		rcu_read_unlock();
 		goto out;
-
+	}
 	rcu_read_unlock();
 	err = cb(transport, p);
 	sctp_transport_put(transport);


Patches currently in stable-queue which might be from lucien.xin@gmail.com are

queue-4.9/sctp-sctp_transport_lookup_process-should-rcu_read_unlock-when-transport-is-null.patch