* [PATCH net] sctp: hold the chunks only after the chunk is enqueued in outq
@ 2015-12-05 7:15 ` Xin Long
0 siblings, 0 replies; 4+ messages in thread
From: Xin Long @ 2015-12-05 7:15 UTC (permalink / raw)
To: network dev, linux-sctp; +Cc: marcelo.leitner, vyasevic, davem
When a msg is sent, sctp will hold the chunks of this msg and then try
to enqueue them. But if the chunks are not enqueued in sctp_outq_tail()
because of the invalid state, sctp_cmd_interpreter() may still return
success to sctp_sendmsg() after calling sctp_outq_flush(), these chunks
will become orphans and will leak.
So we fix them by moving sctp_chunk_hold() to sctp_outq_tail(), where we
are sure that the chunk is going to get queued.
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
---
net/sctp/outqueue.c | 1 +
net/sctp/socket.c | 2 --
2 files changed, 1 insertion(+), 2 deletions(-)
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 7e8f0a1..0b3d818 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -324,6 +324,7 @@ int sctp_outq_tail(struct sctp_outq *q, struct sctp_chunk *chunk)
sctp_cname(SCTP_ST_CHUNK(chunk->chunk_hdr->type)) :
"illegal chunk");
+ sctp_chunk_hold(chunk);
sctp_outq_tail_data(q, chunk);
if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED)
SCTP_INC_STATS(net, SCTP_MIB_OUTUNORDERCHUNKS);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 03c8256..8804731 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1952,8 +1952,6 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
/* Now send the (possibly) fragmented message. */
list_for_each_entry(chunk, &datamsg->chunks, frag_list) {
- sctp_chunk_hold(chunk);
-
/* Do accounting for the write space. */
sctp_set_owner_w(chunk);
--
2.1.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH net] sctp: hold the chunks only after the chunk is enqueued in outq
@ 2015-12-05 7:15 ` Xin Long
0 siblings, 0 replies; 4+ messages in thread
From: Xin Long @ 2015-12-05 7:15 UTC (permalink / raw)
To: network dev, linux-sctp; +Cc: marcelo.leitner, vyasevic, davem
When a msg is sent, sctp will hold the chunks of this msg and then try
to enqueue them. But if the chunks are not enqueued in sctp_outq_tail()
because of the invalid state, sctp_cmd_interpreter() may still return
success to sctp_sendmsg() after calling sctp_outq_flush(), these chunks
will become orphans and will leak.
So we fix them by moving sctp_chunk_hold() to sctp_outq_tail(), where we
are sure that the chunk is going to get queued.
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
---
net/sctp/outqueue.c | 1 +
net/sctp/socket.c | 2 --
2 files changed, 1 insertion(+), 2 deletions(-)
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 7e8f0a1..0b3d818 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -324,6 +324,7 @@ int sctp_outq_tail(struct sctp_outq *q, struct sctp_chunk *chunk)
sctp_cname(SCTP_ST_CHUNK(chunk->chunk_hdr->type)) :
"illegal chunk");
+ sctp_chunk_hold(chunk);
sctp_outq_tail_data(q, chunk);
if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED)
SCTP_INC_STATS(net, SCTP_MIB_OUTUNORDERCHUNKS);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 03c8256..8804731 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1952,8 +1952,6 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
/* Now send the (possibly) fragmented message. */
list_for_each_entry(chunk, &datamsg->chunks, frag_list) {
- sctp_chunk_hold(chunk);
-
/* Do accounting for the write space. */
sctp_set_owner_w(chunk);
--
2.1.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net] sctp: hold the chunks only after the chunk is enqueued in outq
2015-12-05 7:15 ` Xin Long
@ 2015-12-06 18:25 ` David Miller
-1 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2015-12-06 18:25 UTC (permalink / raw)
To: lucien.xin; +Cc: netdev, linux-sctp, marcelo.leitner, vyasevic
From: Xin Long <lucien.xin@gmail.com>
Date: Sat, 5 Dec 2015 15:15:17 +0800
> When a msg is sent, sctp will hold the chunks of this msg and then try
> to enqueue them. But if the chunks are not enqueued in sctp_outq_tail()
> because of the invalid state, sctp_cmd_interpreter() may still return
> success to sctp_sendmsg() after calling sctp_outq_flush(), these chunks
> will become orphans and will leak.
>
> So we fix them by moving sctp_chunk_hold() to sctp_outq_tail(), where we
> are sure that the chunk is going to get queued.
>
> Signed-off-by: Xin Long <lucien.xin@gmail.com>
> Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Applied.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] sctp: hold the chunks only after the chunk is enqueued in outq
@ 2015-12-06 18:25 ` David Miller
0 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2015-12-06 18:25 UTC (permalink / raw)
To: lucien.xin; +Cc: netdev, linux-sctp, marcelo.leitner, vyasevic
From: Xin Long <lucien.xin@gmail.com>
Date: Sat, 5 Dec 2015 15:15:17 +0800
> When a msg is sent, sctp will hold the chunks of this msg and then try
> to enqueue them. But if the chunks are not enqueued in sctp_outq_tail()
> because of the invalid state, sctp_cmd_interpreter() may still return
> success to sctp_sendmsg() after calling sctp_outq_flush(), these chunks
> will become orphans and will leak.
>
> So we fix them by moving sctp_chunk_hold() to sctp_outq_tail(), where we
> are sure that the chunk is going to get queued.
>
> Signed-off-by: Xin Long <lucien.xin@gmail.com>
> Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Applied.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2015-12-06 18:25 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-12-05 7:15 [PATCH net] sctp: hold the chunks only after the chunk is enqueued in outq Xin Long
2015-12-05 7:15 ` Xin Long
2015-12-06 18:25 ` David Miller
2015-12-06 18:25 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.