diff options
| author | lucien <lucien.xin@gmail.com> | 2015-12-05 15:19:27 +0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-12-06 13:25:12 -0500 |
| commit | 8b570dc9f7b634e853866ce40097c0342ac5bb81 (patch) | |
| tree | 646708d19ab120712d0277c0b5840f30e0b55c3b /net | |
| parent | 69b5777f2e5779bb987d4a25a33401d5ac257c14 (diff) | |
| download | linux-8b570dc9f7b634e853866ce40097c0342ac5bb81.tar.gz linux-8b570dc9f7b634e853866ce40097c0342ac5bb81.tar.bz2 linux-8b570dc9f7b634e853866ce40097c0342ac5bb81.zip | |
sctp: only drop the reference on the datamsg after sending a msg
If the chunks are enqueued successfully but sctp_cmd_interpreter()
return err to sctp_sendmsg() (mainly because of no mem), the chunks will
get re-queued, but we are dropping the reference and freeing them.
The fix is to just drop the reference on the datamsg just as it had
succeeded, as:
- if the chunks weren't queued, this is enough to get them freed.
- if they were queued, they will get freed when they finally get out or
discarded.
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sctp/socket.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/net/sctp/socket.c b/net/sctp/socket.c index bd57300c8e91..9b6cc6de80d8 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -1964,15 +1964,13 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len) * breaks. */ err = sctp_primitive_SEND(net, asoc, datamsg); + sctp_datamsg_put(datamsg); /* Did the lower layer accept the chunk? */ - if (err) { - sctp_datamsg_free(datamsg); + if (err) goto out_free; - } pr_debug("%s: we sent primitively\n", __func__); - sctp_datamsg_put(datamsg); err = msg_len; if (unlikely(wait_connect)) { |