lkml.org 
[lkml]   [2019]   [May]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: memory leak in sctp_process_init
On Wed, May 29, 2019 at 03:07:09PM -0400, Neil Horman wrote:
> --- a/net/sctp/sm_make_chunk.c
> +++ b/net/sctp/sm_make_chunk.c
> @@ -2419,9 +2419,12 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
> /* Copy cookie in case we need to resend COOKIE-ECHO. */
> cookie = asoc->peer.cookie;
> if (cookie) {
> + if (asoc->peer.cookie_allocated)
> + kfree(cookie);
> asoc->peer.cookie = kmemdup(cookie, asoc->peer.cookie_len, gfp);
> if (!asoc->peer.cookie)
> goto clean_up;
> + asoc->peer.cookie_allocated=1;
> }
>
> /* RFC 2960 7.2.1 The initial value of ssthresh MAY be arbitrarily

What if we kmemdup directly at sctp_process_param(), as it's done for
others already? Like SCTP_PARAM_RANDOM and SCTP_PARAM_HMAC_ALGO. I
don't see a reason for SCTP_PARAM_STATE_COOKIE to be different
here. This way it would be always allocated, and ready to be kfreed.

We still need to free it after the handshake, btw.

Marcelo

\
 
 \ /
  Last update: 2019-05-30 01:38    [W:2.185 / U:0.700 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site