sctp: fix panic when T2-shutdown timer expire on removed transport

If T2-shutdown timer is expired on a removed transport, kernel
panic will occur when we do failure management on that transport.
You can reproduce this use the following sequence:

  Endpoint A                           Endpoint B
  (ESTABLISHED)                        (ESTABLISHED)

                <-----------------      SHUTDOWN
                                        (SRC=X)
  ASCONF        ----------------->
  (Delete IP Address = X)
                <-----------------      ASCONF-ACK
                                        (Success Indication)
                <-----------------      SHUTDOWN
                                        (T2-shutdown timer expire)
This patch fixed the problem.

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>

1 files changed, 7 insertions, 3 deletions

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 55a61aa69662..10abc07d42cb 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -5432,9 +5432,13 @@ sctp_disposition_t sctp_sf_t2_timer_expire(const struct sctp_endpoint *ep,
         if (!reply)
                 goto nomem;
 
-        /* Do some failure management (Section 8.2). */
-        sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE,
-                        SCTP_TRANSPORT(asoc->shutdown_last_sent_to));
+        /* Do some failure management (Section 8.2).
+         * If we remove the transport an SHUTDOWN was last sent to, don't
+         * do failure management.
+         */
+        if (asoc->shutdown_last_sent_to)
+                sctp_add_cmd_sf(commands, SCTP_CMD_STRIKE,
+                                SCTP_TRANSPORT(asoc->shutdown_last_sent_to));
 
         /* Set the transport for the SHUTDOWN/ACK chunk and the timeout for
          * the T2-shutdown timer.