• Xin Long's avatar
    sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close · a3a3b657
    Xin Long authored
    commit 068d8bd3 upstream.
    
    In sctp_close, sctp_make_abort_user may return NULL because of memory
    allocation failure. If this happens, it will bypass any state change
    and never free the assoc. The assoc has no chance to be freed and it
    will be kept in memory with the state it had even after the socket is
    closed by sctp_close().
    
    So if sctp_make_abort_user fails to allocate memory, we should abort
    the asoc via sctp_primitive_ABORT as well. Just like the annotation in
    sctp_sf_cookie_wait_prm_abort and sctp_sf_do_9_1_prm_abort said,
    "Even if we can't send the ABORT due to low memory delete the TCB.
    This is a departure from our typical NOMEM handling".
    
    But then the chunk is NULL (low memory) and the SCTP_CMD_REPLY cmd would
    dereference the chunk pointer, and system crash. So we should add
    SCTP_CMD_REPLY cmd only when the chunk is not NULL, just like other
    places where it adds SCTP_CMD_REPLY cmd.
    Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
    Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
    a3a3b657
socket.c 203 KB