Commit 8b570dc9 authored Dec 05, 2015 by lucien Committed by David S. Miller Dec 06, 2015

sctp: only drop the reference on the datamsg after sending a msg



If the chunks are enqueued successfully but sctp_cmd_interpreter()
return err to sctp_sendmsg() (mainly because of no mem), the chunks will
get re-queued, but we are dropping the reference and freeing them.

The fix is to just drop the reference on the datamsg just as it had
succeeded, as:
 - if the chunks weren't queued, this is enough to get them freed.
 - if they were queued, they will get freed when they finally get out or
 discarded.

Signed-off-by: Xin Long <lucien.xin@gmail.com>
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 69b5777f

net/sctp/socket.c

+2 −4

Original line number	Diff line number	Diff line
		@@ -1964,15 +1964,13 @@ static int sctp_sendmsg(struct sock sk, struct msghdr msg, size_t msg_len)
		* breaks.
		*/
		err = sctp_primitive_SEND(net, asoc, datamsg);
		sctp_datamsg_put(datamsg);
		/* Did the lower layer accept the chunk? */
		if (err) {
		sctp_datamsg_free(datamsg);
		if (err)
		goto out_free;
		}

		pr_debug("%s: we sent primitively\n", __func__);

		sctp_datamsg_put(datamsg);
		err = msg_len;

		if (unlikely(wait_connect)) {