Commit 69b5777f authored Dec 05, 2015 by lucien Committed by David S. Miller Dec 06, 2015

sctp: hold the chunks only after the chunk is enqueued in outq



When a msg is sent, sctp will hold the chunks of this msg and then try
to enqueue them. But if the chunks are not enqueued in sctp_outq_tail()
because of the invalid state, sctp_cmd_interpreter() may still return
success to sctp_sendmsg() after calling sctp_outq_flush(), these chunks
will become orphans and will leak.

So we fix them by moving sctp_chunk_hold() to sctp_outq_tail(), where we
are sure that the chunk is going to get queued.

Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent ed7d42e2

net/sctp/outqueue.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -324,6 +324,7 @@ int sctp_outq_tail(struct sctp_outq q, struct sctp_chunk chunk)
		sctp_cname(SCTP_ST_CHUNK(chunk->chunk_hdr->type)) :
		"illegal chunk");

		sctp_chunk_hold(chunk);
		sctp_outq_tail_data(q, chunk);
		if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED)
		SCTP_INC_STATS(net, SCTP_MIB_OUTUNORDERCHUNKS);

net/sctp/socket.c

+0 −2

Original line number	Diff line number	Diff line
		@@ -1952,8 +1952,6 @@ static int sctp_sendmsg(struct sock sk, struct msghdr msg, size_t msg_len)

		/* Now send the (possibly) fragmented message. */
		list_for_each_entry(chunk, &datamsg->chunks, frag_list) {
		sctp_chunk_hold(chunk);

		/* Do accounting for the write space. */
		sctp_set_owner_w(chunk);