sctp: clear the new asoc's stream outcnt in sctp_stream_update
When processing a duplicate cookie-echo chunk, sctp moves the new temp asoc's stream out/in into the old asoc, and later frees this new temp asoc. But now after this move, the new temp asoc's stream->outcnt is not cleared while stream->out is set to NULL, which would cause a same crash as the one fixed in Commit79d0895140
("sctp: fix error path in sctp_stream_init") when freeing this asoc later. This fix is to clear this outcnt in sctp_stream_update. Fixes:f952be79ce
("sctp: introduce struct sctp_stream_out_ext") Reported-by: Jianwen Ji <jiji@redhat.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
9306b38e42
commit
6a9a27d539
|
@ -240,6 +240,8 @@ void sctp_stream_update(struct sctp_stream *stream, struct sctp_stream *new)
|
|||
|
||||
new->out = NULL;
|
||||
new->in = NULL;
|
||||
new->outcnt = 0;
|
||||
new->incnt = 0;
|
||||
}
|
||||
|
||||
static int sctp_send_reconf(struct sctp_association *asoc,
|
||||
|
|
Loading…
Reference in a new issue