From: Vegard Nossum
Date: Fri, 12 Aug 2016 09:50:51 +0200
> sctp_transport_seq_start() does not currently clear iter->start_fail on
> success, but relies on it being zero when it is allocated (by
> seq_open_net()).
>
> This can be a problem in the following sequence:
>
> open() // allocates
On Fri, Aug 12, 2016 at 09:50:51AM +0200, Vegard Nossum wrote:
> sctp_transport_seq_start() does not currently clear iter->start_fail on
> success, but relies on it being zero when it is allocated (by
> seq_open_net()).
>
> This can be a problem in the following sequence:
>
> open() // alloca
On Fri, Aug 12, 2016 at 09:50:51AM +0200, Vegard Nossum wrote:
> sctp_transport_seq_start() does not currently clear iter->start_fail on
> success, but relies on it being zero when it is allocated (by
> seq_open_net()).
>
> This can be a problem in the following sequence:
>
> open() // alloca
sctp_transport_seq_start() does not currently clear iter->start_fail on
success, but relies on it being zero when it is allocated (by
seq_open_net()).
This can be a problem in the following sequence:
open() // allocates iter (and implicitly sets iter->start_fail = 0)
read()
- iter->s