Skip to main content

Browse the archive

https://github.com/torvalds/linux
27 March 2024, 02:37:15 UTC
Revision 068d8bd338e855286aea54e70d1c101569284b21 authored by Xin Long on 29 December 2015, 09:49:25 UTC, committed by David S. Miller on 30 December 2015, 21:57:16 UTC 
sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close
 
In sctp_close, sctp_make_abort_user may return NULL because of memory
allocation failure. If this happens, it will bypass any state change
and never free the assoc. The assoc has no chance to be freed and it
will be kept in memory with the state it had even after the socket is
closed by sctp_close().

So if sctp_make_abort_user fails to allocate memory, we should abort
the asoc via sctp_primitive_ABORT as well. Just like the annotation in
sctp_sf_cookie_wait_prm_abort and sctp_sf_do_9_1_prm_abort said,
"Even if we can't send the ABORT due to low memory delete the TCB.
This is a departure from our typical NOMEM handling".

But then the chunk is NULL (low memory) and the SCTP_CMD_REPLY cmd would
dereference the chunk pointer, and system crash. So we should add
SCTP_CMD_REPLY cmd only when the chunk is not NULL, just like other
places where it adds SCTP_CMD_REPLY cmd.

Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent a0ccc3f
History
Tip revision: 068d8bd338e855286aea54e70d1c101569284b21 authored by Xin Long on 29 December 2015, 09:49:25 UTC
sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close
Tip revision: 068d8bd
File Mode Size
Documentation
arch
block
certs
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.get_maintainer.ignore -rw-r--r-- 31 bytes
.gitignore -rw-r--r-- 1.2 KB
.mailmap -rw-r--r-- 5.4 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 94.9 KB
Kbuild -rw-r--r-- 2.6 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 328.7 KB
Makefile -rw-r--r-- 53.5 KB
README -rw-r--r-- 18.2 KB
REPORTING-BUGS -rw-r--r-- 7.3 KB

README

back to top