diff options
author | Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> | 2019-12-16 22:01:16 -0300 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-12-31 16:41:34 +0100 |
commit | 62870e2a06467a52090373b18ddea073a6486401 (patch) | |
tree | a4f7f058feac52898db0608a9664212d50753f5b /net | |
parent | b315f8a6da442954d7d92dd1bc67587e09e39bf2 (diff) | |
download | linux-stable-62870e2a06467a52090373b18ddea073a6486401.tar.gz linux-stable-62870e2a06467a52090373b18ddea073a6486401.tar.bz2 linux-stable-62870e2a06467a52090373b18ddea073a6486401.zip |
sctp: fix memleak on err handling of stream initialization
[ Upstream commit 951c6db954a1adefab492f6da805decacabbd1a7 ]
syzbot reported a memory leak when an allocation fails within
genradix_prealloc() for output streams. That's because
genradix_prealloc() leaves initialized members initialized when the
issue happens and SCTP stack will abort the current initialization but
without cleaning up such members.
The fix here is to always call genradix_free() when genradix_prealloc()
fails, for output and also input streams, as it suffers from the same
issue.
Reported-by: syzbot+772d9e36c490b18d51d1@syzkaller.appspotmail.com
Fixes: 2075e50caf5e ("sctp: convert to genradix")
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Tested-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
-rw-r--r-- | net/sctp/stream.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/net/sctp/stream.c b/net/sctp/stream.c index e83cdaa2ab76..6a30392068a0 100644 --- a/net/sctp/stream.c +++ b/net/sctp/stream.c @@ -84,8 +84,10 @@ static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt, return 0; ret = genradix_prealloc(&stream->out, outcnt, gfp); - if (ret) + if (ret) { + genradix_free(&stream->out); return ret; + } stream->outcnt = outcnt; return 0; @@ -100,8 +102,10 @@ static int sctp_stream_alloc_in(struct sctp_stream *stream, __u16 incnt, return 0; ret = genradix_prealloc(&stream->in, incnt, gfp); - if (ret) + if (ret) { + genradix_free(&stream->in); return ret; + } stream->incnt = incnt; return 0; |