• Marcelo Ricardo Leitner's avatar
    sctp: fix err handling of stream initialization · 61d5d406
    Marcelo Ricardo Leitner authored
    The fix on 951c6db9 fixed the issued reported there but introduced
    another. When the allocation fails within sctp_stream_init() it is
    okay/necessary to free the genradix. But it is also called when adding
    new streams, from sctp_send_add_streams() and
    sctp_process_strreset_addstrm_in() and in those situations it cannot
    just free the genradix because by then it is a fully operational
    association.
    
    The fix here then is to only free the genradix in sctp_stream_init()
    and on those other call sites  move on with what it already had and let
    the subsequent error handling to handle it.
    
    Tested with the reproducers from this report and the previous one,
    with lksctp-tools and sctp-tests.
    
    Reported-by: syzbot+9a1bc632e78a1a98488b@syzkaller.appspotmail.com
    Fixes: 951c6db9 ("sctp: fix memleak on err handling of stream initialization")
    Signed-off-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    61d5d406
stream.c 26.3 KB