diff options
author | Xin Long <lucien.xin@gmail.com> | 2020-02-18 07:07:53 +0300 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2020-02-18 08:56:03 +0300 |
commit | 245709ec8be89af46ea7ef0444c9c80913999d99 (patch) | |
tree | 8bfb082154e897dafb0bd3951ec828c9558249c4 /drivers/net/ethernet/broadcom/cnic_defs.h | |
parent | 8a9093c79863b58cc2f9874d7ae788f0d622a596 (diff) | |
download | linux-245709ec8be89af46ea7ef0444c9c80913999d99.tar.xz |
sctp: move the format error check out of __sctp_sf_do_9_1_abort
When T2 timer is to be stopped, the asoc should also be deleted,
otherwise, there will be no chance to call sctp_association_free
and the asoc could last in memory forever.
However, in sctp_sf_shutdown_sent_abort(), after adding the cmd
SCTP_CMD_TIMER_STOP for T2 timer, it may return error due to the
format error from __sctp_sf_do_9_1_abort() and miss adding
SCTP_CMD_ASSOC_FAILED where the asoc will be deleted.
This patch is to fix it by moving the format error check out of
__sctp_sf_do_9_1_abort(), and do it before adding the cmd
SCTP_CMD_TIMER_STOP for T2 timer.
Thanks Hangbin for reporting this issue by the fuzz testing.
v1->v2:
- improve the comment in the code as Marcelo's suggestion.
Fixes: 96ca468b86b0 ("sctp: check invalid value of length parameter in error cause")
Reported-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/broadcom/cnic_defs.h')
0 files changed, 0 insertions, 0 deletions