Commit 951c6db9 authored by Marcelo Ricardo Leitner's avatar Marcelo Ricardo Leitner Committed by David S. Miller

sctp: fix memleak on err handling of stream initialization

syzbot reported a memory leak when an allocation fails within
genradix_prealloc() for output streams. That's because
genradix_prealloc() leaves initialized members initialized when the
issue happens and SCTP stack will abort the current initialization but
without cleaning up such members.

The fix here is to always call genradix_free() when genradix_prealloc()
fails, for output and also input streams, as it suffers from the same
issue.

Reported-by: syzbot+772d9e36c490b18d51d1@syzkaller.appspotmail.com
Fixes: 2075e50c ("sctp: convert to genradix")
Signed-off-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Tested-by: default avatarXin Long <lucien.xin@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 040cda8a
...@@ -84,8 +84,10 @@ static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt, ...@@ -84,8 +84,10 @@ static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt,
return 0; return 0;
ret = genradix_prealloc(&stream->out, outcnt, gfp); ret = genradix_prealloc(&stream->out, outcnt, gfp);
if (ret) if (ret) {
genradix_free(&stream->out);
return ret; return ret;
}
stream->outcnt = outcnt; stream->outcnt = outcnt;
return 0; return 0;
...@@ -100,8 +102,10 @@ static int sctp_stream_alloc_in(struct sctp_stream *stream, __u16 incnt, ...@@ -100,8 +102,10 @@ static int sctp_stream_alloc_in(struct sctp_stream *stream, __u16 incnt,
return 0; return 0;
ret = genradix_prealloc(&stream->in, incnt, gfp); ret = genradix_prealloc(&stream->in, incnt, gfp);
if (ret) if (ret) {
genradix_free(&stream->in);
return ret; return ret;
}
stream->incnt = incnt; stream->incnt = incnt;
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment