Skip to content
  • Xufeng Zhang's avatar
    sctp: Fix sk_ack_backlog wrap-around problem · d3217b15
    Xufeng Zhang authored
    
    
    Consider the scenario:
    For a TCP-style socket, while processing the COOKIE_ECHO chunk in
    sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check,
    a new association would be created in sctp_unpack_cookie(), but afterwards,
    some processing maybe failed, and sctp_association_free() will be called to
    free the previously allocated association, in sctp_association_free(),
    sk_ack_backlog value is decremented for this socket, since the initial
    value for sk_ack_backlog is 0, after the decrement, it will be 65535,
    a wrap-around problem happens, and if we want to establish new associations
    afterward in the same socket, ABORT would be triggered since sctp deem the
    accept queue as full.
    Fix this issue by only decrementing sk_ack_backlog for associations in
    the endpoint's list.
    
    Fix-suggested-by: default avatarNeil Horman <nhorman@tuxdriver.com>
    Signed-off-by: default avatarXufeng Zhang <xufeng.zhang@windriver.com>
    Acked-by: default avatarDaniel Borkmann <dborkman@redhat.com>
    Acked-by: default avatarVlad Yasevich <vyasevich@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    d3217b15