diff options
| author | lucien | 2015-12-05 08:15:17 +0100 |
|---|---|---|
| committer | David S. Miller | 2015-12-06 19:25:12 +0100 |
| commit | 69b5777f2e5779bb987d4a25a33401d5ac257c14 (patch) | |
| tree | 1333f49fe1b4d26f42c0d398a8f548314b81b1b8 /net/sctp/socket.c | |
| parent | net: qca_spi: fix transmit queue timeout handling (diff) | |
| download | kernel-qcow2-linux-69b5777f2e5779bb987d4a25a33401d5ac257c14.tar.gz kernel-qcow2-linux-69b5777f2e5779bb987d4a25a33401d5ac257c14.tar.xz kernel-qcow2-linux-69b5777f2e5779bb987d4a25a33401d5ac257c14.zip | |
sctp: hold the chunks only after the chunk is enqueued in outq
When a msg is sent, sctp will hold the chunks of this msg and then try
to enqueue them. But if the chunks are not enqueued in sctp_outq_tail()
because of the invalid state, sctp_cmd_interpreter() may still return
success to sctp_sendmsg() after calling sctp_outq_flush(), these chunks
will become orphans and will leak.
So we fix them by moving sctp_chunk_hold() to sctp_outq_tail(), where we
are sure that the chunk is going to get queued.
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sctp/socket.c')
| -rw-r--r-- | net/sctp/socket.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 1a32ecdb8bae..bd57300c8e91 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -1952,8 +1952,6 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len) /* Now send the (possibly) fragmented message. */ list_for_each_entry(chunk, &datamsg->chunks, frag_list) { - sctp_chunk_hold(chunk); - /* Do accounting for the write space. */ sctp_set_owner_w(chunk); |