Skip to content

Commit d3217b1

Browse files
Xufeng Zhangdavem330
Xufeng Zhang
authored andcommitted
sctp: Fix sk_ack_backlog wrap-around problem
Consider the scenario: For a TCP-style socket, while processing the COOKIE_ECHO chunk in sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check, a new association would be created in sctp_unpack_cookie(), but afterwards, some processing maybe failed, and sctp_association_free() will be called to free the previously allocated association, in sctp_association_free(), sk_ack_backlog value is decremented for this socket, since the initial value for sk_ack_backlog is 0, after the decrement, it will be 65535, a wrap-around problem happens, and if we want to establish new associations afterward in the same socket, ABORT would be triggered since sctp deem the accept queue as full. Fix this issue by only decrementing sk_ack_backlog for associations in the endpoint's list. Fix-suggested-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: Xufeng Zhang <xufeng.zhang@windriver.com> Acked-by: Daniel Borkmann <dborkman@redhat.com> Acked-by: Vlad Yasevich <vyasevich@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 902455e commit d3217b1

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

Diff for: net/sctp/associola.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -331,7 +331,7 @@ void sctp_association_free(struct sctp_association *asoc)
331331
/* Only real associations count against the endpoint, so
332332
* don't bother for if this is a temporary association.
333333
*/
334-
if (!asoc->temp) {
334+
if (!list_empty(&asoc->asocs)) {
335335
list_del(&asoc->asocs);
336336

337337
/* Decrement the backlog value for a TCP-style listening

0 commit comments

Comments
 (0)