Commit 62870e2a authored Dec 16, 2019 by Marcelo Ricardo Leitner Committed by Greg Kroah-Hartman Dec 31, 2019

sctp: fix memleak on err handling of stream initialization



[ Upstream commit 951c6db954a1adefab492f6da805decacabbd1a7 ]

syzbot reported a memory leak when an allocation fails within
genradix_prealloc() for output streams. That's because
genradix_prealloc() leaves initialized members initialized when the
issue happens and SCTP stack will abort the current initialization but
without cleaning up such members.

The fix here is to always call genradix_free() when genradix_prealloc()
fails, for output and also input streams, as it suffers from the same
issue.

Reported-by:  <syzbot+772d9e36c490b18d51d1@syzkaller.appspotmail.com>
Fixes: 2075e50c ("sctp: convert to genradix")
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Tested-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent b315f8a6

net/sctp/stream.c

+6 −2

Original line number	Diff line number	Diff line
		@@ -84,8 +84,10 @@ static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt,
		return 0;

		ret = genradix_prealloc(&stream->out, outcnt, gfp);
		if (ret)
		if (ret) {
		genradix_free(&stream->out);
		return ret;
		}

		stream->outcnt = outcnt;
		return 0;
		@@ -100,8 +102,10 @@ static int sctp_stream_alloc_in(struct sctp_stream *stream, __u16 incnt,
		return 0;

		ret = genradix_prealloc(&stream->in, incnt, gfp);
		if (ret)
		if (ret) {
		genradix_free(&stream->in);
		return ret;
		}

		stream->incnt = incnt;
		return 0;