Hi! On Thu 2019-06-20 19:57:05, Greg Kroah-Hartman wrote: > From: Neil Horman <[email protected]> > > [ Upstream commit ce950f1050cece5e406a5cde723c69bba60e1b26 ] > > Based on comments from Xin, even after fixes for our recent syzbot > report of cookie memory leaks, its possible to get a resend of an INIT > chunk which would lead to us leaking cookie memory. >
> --- a/net/sctp/sm_make_chunk.c
> +++ b/net/sctp/sm_make_chunk.c
> @@ -2600,6 +2600,8 @@ do_addr_param:
> case SCTP_PARAM_STATE_COOKIE:
> asoc->peer.cookie_len =
> ntohs(param.p->length) - sizeof(struct sctp_paramhdr);
> + if (asoc->peer.cookie)
> + kfree(asoc->peer.cookie);
> asoc->peer.cookie = kmemdup(param.cookie->body,
> asoc->peer.cookie_len, gfp);
> if (!asoc->peer.cookie)
> retval = 0;
kfree() handles NULL just fine. Can we simply work without the tests
and save a bit of code?
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures)
http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
signature.asc
Description: Digital signature
