sctp: reset ret in again path in sctp_for_each_transport
authorXin Long <lucien.xin@gmail.com>
Tue, 23 Jan 2018 10:22:25 +0000 (18:22 +0800)
committerDavid S. Miller <davem@davemloft.net>
Tue, 23 Jan 2018 16:22:25 +0000 (11:22 -0500)
commitf53d77e19b6587527a3dd60a0e638f115e5cd7a9
treeaaf4ecd21339dcd54865856a95649b2c9739bcb5
parent196709f4942dfc70e11088a025f3e14305117393
sctp: reset ret in again path in sctp_for_each_transport

Commit 97a6ec4ac021 ("rhashtable: Change rhashtable_walk_start to
return void") only initialized ret for the first time, when going
to again path, the next tsp could be NULL. Without resetting ret,
cb_done would be called with tsp as NULL.

A kernel crash was caused by this when running sctpdiag testcase
in sctp-tests.

Note that this issue doesn't affect net.git yet.

Fixes: 97a6ec4ac021 ("rhashtable: Change rhashtable_walk_start to return void")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/sctp/socket.c