CVE-2010-4526 kernel: sctp: a race between ICMP protocol unreachable and connect()

[Eugene Teo <eugene () redhat com>]

http://git.kernel.org/linus/50b5d6ad63821cea324a5a7a19854d4de1a0a819
https://bugzilla.redhat.com/CVE-2010-4526

commit 50b5d6ad63821cea324a5a7a19854d4de1a0a819
Author: Vlad Yasevich <vladislav.yasevich () hp com>
Date:   Thu May 6 00:56:07 2010 -0700

sctp: Fix a race between ICMP protocol unreachable and connect()

    ICMP protocol unreachable handling completely disregarded
    the fact that the user may have locked the socket.  It proceeded
    to destroy the association, even though the user may have
    held the lock and had a ref on the association.
[...]
    This was because the sctp_wait_for_connect() would aqcure the socket
    lock and then proceed to release the last reference count on the
    association, thus cause the fully destruction path to finish freeing
    the socket.

This affects kernels v2.6.11-rc2 and above.

Thanks, Eugene