summaryrefslogtreecommitdiff
path: root/net/sctp/stream.c
diff options
context:
space:
mode:
authorXin Long <lucien.xin@gmail.com>2018-04-26 10:21:44 +0300
committerDavid S. Miller <davem@davemloft.net>2018-04-27 20:34:34 +0300
commit6a9a27d5397fc6c52f90c09ddab91e65053584aa (patch)
treea72c1b77d12c5a5257b3d21276d84e3873325f86 /net/sctp/stream.c
parent9306b38e42cb266f98bff6f6f4c1c652aa79ba45 (diff)
downloadlinux-6a9a27d5397fc6c52f90c09ddab91e65053584aa.tar.xz
sctp: clear the new asoc's stream outcnt in sctp_stream_update
When processing a duplicate cookie-echo chunk, sctp moves the new temp asoc's stream out/in into the old asoc, and later frees this new temp asoc. But now after this move, the new temp asoc's stream->outcnt is not cleared while stream->out is set to NULL, which would cause a same crash as the one fixed in Commit 79d0895140e9 ("sctp: fix error path in sctp_stream_init") when freeing this asoc later. This fix is to clear this outcnt in sctp_stream_update. Fixes: f952be79cebd ("sctp: introduce struct sctp_stream_out_ext") Reported-by: Jianwen Ji <jiji@redhat.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sctp/stream.c')
-rw-r--r--net/sctp/stream.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index f799043abec9..f1f1d1b232ba 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -240,6 +240,8 @@ void sctp_stream_update(struct sctp_stream *stream, struct sctp_stream *new)
new->out = NULL;
new->in = NULL;
+ new->outcnt = 0;
+ new->incnt = 0;
}
static int sctp_send_reconf(struct sctp_association *asoc,