Xin Long 068d8bd338 sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close ... In sctp_close, sctp_make_abort_user may return NULL because of memory allocation failure. If this happens, it will bypass any state change and never free the assoc. The assoc has no chance to be freed and it will be kept in memory with the state it had even after the socket is closed by sctp_close(). So if sctp_make_abort_user fails to allocate memory, we should abort the asoc via sctp_primitive_ABORT as well. Just like the annotation in sctp_sf_cookie_wait_prm_abort and sctp_sf_do_9_1_prm_abort said, "Even if we can't send the ABORT due to low memory delete the TCB. This is a departure from our typical NOMEM handling". But then the chunk is NULL (low memory) and the SCTP_CMD_REPLY cmd would dereference the chunk pointer, and system crash. So we should add SCTP_CMD_REPLY cmd only when the chunk is not NULL, just like other places where it adds SCTP_CMD_REPLY cmd. Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2015-12-30 16:57:16 -05:00
..
associola.c
auth.c	sctp: translate host order to network order when setting a hmacid	2015-11-15 18:27:27 -05:00
bind_addr.c
chunk.c
debug.c
endpointola.c
input.c
inqueue.c
ipv6.c	ipv6: sctp: clone options to avoid use after free	2015-12-11 20:18:40 -05:00
Kconfig
Makefile
objcnt.c
output.c
outqueue.c	sctp: start t5 timer only when peer rwnd is 0 and local state is SHUTDOWN_PENDING	2015-12-06 22:31:51 -05:00
primitive.c
probe.c
proc.c
protocol.c
sm_make_chunk.c	sctp: use the same clock as if sock source timestamps were on	2015-12-05 22:23:22 -05:00
sm_sideeffect.c
sm_statefuns.c	sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close	2015-12-30 16:57:16 -05:00
sm_statetable.c
socket.c	sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close	2015-12-30 16:57:16 -05:00
ssnmap.c
sysctl.c
transport.c	remove abs64()	2015-11-09 15:11:24 -08:00
tsnmap.c
ulpevent.c
ulpqueue.c