diff for duplicates of <20190604205904.GA3778@localhost.localdomain> diff --git a/a/1.txt b/N1/1.txt index 0a50268..a18519b 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -53,7 +53,7 @@ On Wed, Jun 05, 2019 at 04:16:24AM +0800, Xin Long wrote: > This's not gonna happen, as after processing INIT, the temp asoc will be > deleted on the server side. Besides, from the reproducer: > -> https://syzkaller.appspot.com/x/repro.syz?x\x10e32f8ca00000 +> https://syzkaller.appspot.com/x/repro.syz?x=10e32f8ca00000 > > Packet(INIT|COOKIE_ECHO) can't be made in here. > @@ -90,7 +90,8 @@ now, sorry for the rushiness) > > @@ -881,6 +893,18 @@ static void sctp_cmd_new_state(struct sctp_cmd_seq *cmds, > asoc->rto_initial; -> asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE] > asoc->rto_initial; +> asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE] = +> asoc->rto_initial; > + > + if (asoc->peer.cookie) { > + kfree(asoc->peer.cookie); @@ -159,7 +160,8 @@ now, sorry for the rushiness) > > * advertised window). > > @@ -2607,7 +2598,9 @@ static int sctp_process_param(struct sctp_association *asoc, > > case SCTP_PARAM_STATE_COOKIE: -> > asoc->peer.cookie_len > > ntohs(param.p->length) - sizeof(struct sctp_paramhdr); +> > asoc->peer.cookie_len = +> > ntohs(param.p->length) - sizeof(struct sctp_paramhdr); > > - asoc->peer.cookie = param.cookie->body; > > + asoc->peer.cookie = kmemdup(param.cookie->body, asoc->peer.cookie_len, gfp); > > + if (!asoc->peer.cookie) diff --git a/a/content_digest b/N1/content_digest index cb42d56..52d0b39 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -3,7 +3,7 @@ "ref\0CADvbK_c6Ym2pbKqGQD8WUmUPX_PtAa6RGde7AQwhRZzUr_emiw@mail.gmail.com\0" "From\0Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>\0" "Subject\0Re: [PATCH V2] Fix memory leak in sctp_process_init\0" - "Date\0Tue, 04 Jun 2019 20:59:04 +0000\0" + "Date\0Tue, 4 Jun 2019 17:59:04 -0300\0" "To\0Xin Long <lucien.xin@gmail.com>\0" "Cc\0Neil Horman <nhorman@tuxdriver.com>" linux-sctp@vger.kernel.org @@ -67,7 +67,7 @@ "> This's not gonna happen, as after processing INIT, the temp asoc will be\n" "> deleted on the server side. Besides, from the reproducer:\n" "> \n" - "> https://syzkaller.appspot.com/x/repro.syz?x\020e32f8ca00000\n" + "> https://syzkaller.appspot.com/x/repro.syz?x=10e32f8ca00000\n" "> \n" "> Packet(INIT|COOKIE_ECHO) can't be made in here.\n" "> \n" @@ -104,7 +104,8 @@ "> \n" "> @@ -881,6 +893,18 @@ static void sctp_cmd_new_state(struct sctp_cmd_seq *cmds,\n" "> asoc->rto_initial;\n" - "> asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE] > asoc->rto_initial;\n" + "> asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE] =\n" + "> asoc->rto_initial;\n" "> +\n" "> + if (asoc->peer.cookie) {\n" "> + kfree(asoc->peer.cookie);\n" @@ -173,7 +174,8 @@ "> > * advertised window).\n" "> > @@ -2607,7 +2598,9 @@ static int sctp_process_param(struct sctp_association *asoc,\n" "> > case SCTP_PARAM_STATE_COOKIE:\n" - "> > asoc->peer.cookie_len > > ntohs(param.p->length) - sizeof(struct sctp_paramhdr);\n" + "> > asoc->peer.cookie_len =\n" + "> > ntohs(param.p->length) - sizeof(struct sctp_paramhdr);\n" "> > - asoc->peer.cookie = param.cookie->body;\n" "> > + asoc->peer.cookie = kmemdup(param.cookie->body, asoc->peer.cookie_len, gfp);\n" "> > + if (!asoc->peer.cookie)\n" @@ -202,4 +204,4 @@ "> >\n" > -7a52e5206d7cbca86041c0c47c58521660b88ac2ff19bafdac4e7a1f41b464e1 +68140f150379ca8fe3074f34d8e90be2be72083611307065219dee8d88e6b88d
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.