summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authortuexen <tuexen@FreeBSD.org>2014-06-22 16:45:42 +0000
committertuexen <tuexen@FreeBSD.org>2014-06-22 16:45:42 +0000
commit08bf57727433041944d851795e4c8e34f8c54d89 (patch)
tree900ddc7f7c02435e4ecbeafef99edf5222a65eca
parentd6a02f0073c626dcc7561b537fdc840d24e5339a (diff)
downloadFreeBSD-src-08bf57727433041944d851795e4c8e34f8c54d89.zip
FreeBSD-src-08bf57727433041944d851795e4c8e34f8c54d89.tar.gz
MFC r264838:
Don't free an mbuf twice. This only happens in very rare error cases where the peer sends illegal sequencing information in DATA chunks for an existing association.
-rw-r--r--sys/netinet/sctp_indata.c16
1 files changed, 15 insertions, 1 deletions
diff --git a/sys/netinet/sctp_indata.c b/sys/netinet/sctp_indata.c
index 4b1a666..52ba865 100644
--- a/sys/netinet/sctp_indata.c
+++ b/sys/netinet/sctp_indata.c
@@ -1717,6 +1717,9 @@ failed_pdapi_express_del:
stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_15;
sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
*abort_flag = 1;
+ if (last_chunk) {
+ *m = NULL;
+ }
return (0);
} else {
if (sctp_does_tsn_belong_to_reasm(asoc, control->sinfo_tsn)) {
@@ -1733,6 +1736,9 @@ failed_pdapi_express_del:
stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_16;
sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
*abort_flag = 1;
+ if (last_chunk) {
+ *m = NULL;
+ }
return (0);
}
}
@@ -1759,6 +1765,9 @@ failed_pdapi_express_del:
stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_17;
sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
*abort_flag = 1;
+ if (last_chunk) {
+ *m = NULL;
+ }
return (0);
}
}
@@ -1822,6 +1831,9 @@ failed_pdapi_express_del:
} else {
sctp_queue_data_to_stream(stcb, asoc, control, abort_flag);
if (*abort_flag) {
+ if (last_chunk) {
+ *m = NULL;
+ }
return (0);
}
}
@@ -1834,7 +1846,9 @@ failed_pdapi_express_del:
* the assoc is now gone and chk was put onto the
* reasm queue, which has all been freed.
*/
- *m = NULL;
+ if (last_chunk) {
+ *m = NULL;
+ }
return (0);
}
}
OpenPOWER on IntegriCloud