diff options
author | Xin Long <lucien.xin@gmail.com> | 2020-02-18 12:07:53 +0800 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2020-02-17 21:56:03 -0800 |
commit | 245709ec8be89af46ea7ef0444c9c80913999d99 (patch) | |
tree | 8bfb082154e897dafb0bd3951ec828c9558249c4 /drivers/net | |
parent | 8a9093c79863b58cc2f9874d7ae788f0d622a596 (diff) | |
download | linux-245709ec8be89af46ea7ef0444c9c80913999d99.tar.gz linux-245709ec8be89af46ea7ef0444c9c80913999d99.tar.bz2 linux-245709ec8be89af46ea7ef0444c9c80913999d99.zip |
sctp: move the format error check out of __sctp_sf_do_9_1_abort
When T2 timer is to be stopped, the asoc should also be deleted,
otherwise, there will be no chance to call sctp_association_free
and the asoc could last in memory forever.
However, in sctp_sf_shutdown_sent_abort(), after adding the cmd
SCTP_CMD_TIMER_STOP for T2 timer, it may return error due to the
format error from __sctp_sf_do_9_1_abort() and miss adding
SCTP_CMD_ASSOC_FAILED where the asoc will be deleted.
This patch is to fix it by moving the format error check out of
__sctp_sf_do_9_1_abort(), and do it before adding the cmd
SCTP_CMD_TIMER_STOP for T2 timer.
Thanks Hangbin for reporting this issue by the fuzz testing.
v1->v2:
- improve the comment in the code as Marcelo's suggestion.
Fixes: 96ca468b86b0 ("sctp: check invalid value of length parameter in error cause")
Reported-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net')
0 files changed, 0 insertions, 0 deletions