Commit 9abed245 authored by Jesper Juhl's avatar Jesper Juhl Committed by Vlad Yasevich

Fix memory leak in discard case of sctp_sf_abort_violation()

In net/sctp/sm_statefuns.c::sctp_sf_abort_violation() we may leak
the storage allocated for 'abort' by returning from the function
without using or freeing it. This happens in case
"sctp_auth_recv_cid(SCTP_CID_ABORT, asoc)" is true and we jump to
the 'discard' label.
Spotted by the Coverity checker.

The simple fix is to simply move the creation of the "abort chunk"
to after the possible jump to the 'discard' label. This way we don't
even have to allocate the memory at all in the problem case.
Signed-off-by: default avatarJesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: default avatarVlad Yasevich <vladislav.yasevich@hp.com>
parent 7d54dc68
...@@ -4064,11 +4064,6 @@ static sctp_disposition_t sctp_sf_abort_violation( ...@@ -4064,11 +4064,6 @@ static sctp_disposition_t sctp_sf_abort_violation(
struct sctp_chunk *chunk = arg; struct sctp_chunk *chunk = arg;
struct sctp_chunk *abort = NULL; struct sctp_chunk *abort = NULL;
/* Make the abort chunk. */
abort = sctp_make_abort_violation(asoc, chunk, payload, paylen);
if (!abort)
goto nomem;
/* SCTP-AUTH, Section 6.3: /* SCTP-AUTH, Section 6.3:
* It should be noted that if the receiver wants to tear * It should be noted that if the receiver wants to tear
* down an association in an authenticated way only, the * down an association in an authenticated way only, the
...@@ -4083,6 +4078,11 @@ static sctp_disposition_t sctp_sf_abort_violation( ...@@ -4083,6 +4078,11 @@ static sctp_disposition_t sctp_sf_abort_violation(
if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc)) if (sctp_auth_recv_cid(SCTP_CID_ABORT, asoc))
goto discard; goto discard;
/* Make the abort chunk. */
abort = sctp_make_abort_violation(asoc, chunk, payload, paylen);
if (!abort)
goto nomem;
if (asoc) { if (asoc) {
sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort)); sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS); SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment