From e9578ada2f9807d2cf2bbb076396d74baaaa4a11 Mon Sep 17 00:00:00 2001
From: tuexen <tuexen@FreeBSD.org>
Date: Mon, 11 Mar 2013 17:43:55 +0000
Subject: Return an error if sctp_peeloff() fails because a socket can't be
 allocated.

MFC after: 3 days
---
 sys/kern/uipc_socket.c   | 7 ++++++-
 sys/kern/uipc_syscalls.c | 4 +++-
 2 files changed, 9 insertions(+), 2 deletions(-)

(limited to 'sys')

diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c
index 7fcac1c..aa5448c 100644
--- a/sys/kern/uipc_socket.c
+++ b/sys/kern/uipc_socket.c
@@ -136,6 +136,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/uio.h>
 #include <sys/jail.h>
 #include <sys/syslog.h>
+#include <netinet/in.h>
 
 #include <net/vnet.h>
 
@@ -565,8 +566,12 @@ sonewconn(struct socket *head, int connstatus)
 	/*
 	 * The accept socket may be tearing down but we just
 	 * won a race on the ACCEPT_LOCK.
+	 * However, if sctp_peeloff() is called on a 1-to-many
+	 * style socket, the SO_ACCEPTCONN doesn't need to be set.
 	 */
-	if (!(head->so_options & SO_ACCEPTCONN)) {
+	if (!(head->so_options & SO_ACCEPTCONN) &&
+	    ((head->so_proto->pr_protocol != IPPROTO_SCTP) ||
+	     (head->so_type != SOCK_SEQPACKET))) {
 		SOCK_LOCK(so);
 		so->so_head = NULL;
 		sofree(so);		/* NB: returns ACCEPT_UNLOCK'ed. */
diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c
index 894cffc..a262306 100644
--- a/sys/kern/uipc_syscalls.c
+++ b/sys/kern/uipc_syscalls.c
@@ -2386,8 +2386,10 @@ sys_sctp_peeloff(td, uap)
 
 	CURVNET_SET(head->so_vnet);
 	so = sonewconn(head, SS_ISCONNECTED);
-	if (so == NULL)
+	if (so == NULL) {
+		error = ENOMEM;
 		goto noconnection;
+	}
 	/*
 	 * Before changing the flags on the socket, we have to bump the
 	 * reference count.  Otherwise, if the protocol calls sofree(),
-- 
cgit v1.1