sctp: fix memleak on err handling of stream initialization
[ Upstream commit951c6db954
] syzbot reported a memory leak when an allocation fails within genradix_prealloc() for output streams. That's because genradix_prealloc() leaves initialized members initialized when the issue happens and SCTP stack will abort the current initialization but without cleaning up such members. The fix here is to always call genradix_free() when genradix_prealloc() fails, for output and also input streams, as it suffers from the same issue. Reported-by: syzbot+772d9e36c490b18d51d1@syzkaller.appspotmail.com Fixes:2075e50caf
("sctp: convert to genradix") Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Tested-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
b315f8a6da
commit
62870e2a06
|
@ -84,8 +84,10 @@ static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt,
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
ret = genradix_prealloc(&stream->out, outcnt, gfp);
|
ret = genradix_prealloc(&stream->out, outcnt, gfp);
|
||||||
if (ret)
|
if (ret) {
|
||||||
|
genradix_free(&stream->out);
|
||||||
return ret;
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
stream->outcnt = outcnt;
|
stream->outcnt = outcnt;
|
||||||
return 0;
|
return 0;
|
||||||
|
@ -100,8 +102,10 @@ static int sctp_stream_alloc_in(struct sctp_stream *stream, __u16 incnt,
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
ret = genradix_prealloc(&stream->in, incnt, gfp);
|
ret = genradix_prealloc(&stream->in, incnt, gfp);
|
||||||
if (ret)
|
if (ret) {
|
||||||
|
genradix_free(&stream->in);
|
||||||
return ret;
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
stream->incnt = incnt;
|
stream->incnt = incnt;
|
||||||
return 0;
|
return 0;
|
||||||
|
|
Loading…
Reference in a new issue