diff options
| author |   Arnaldo Carvalho de Melo <acme@mandriva.com> | 2005-08-23 21:50:21 -0700 |
|---|---|---|
| committer |   David S. Miller <davem@sunset.davemloft.net> | 2005-08-29 16:04:38 -0700 |
| commit | 20472af986569b0615bd77f0fd7ca9e3d33e9895 (patch) | |
| tree | 1f2fe837d53cc894c81710623bb1fd99f3b52a8d /net/dccp/proto.c | |
| parent | [DCCP]: Implement the CLOSING timer (diff) | |
| download | linux-dev-20472af986569b0615bd77f0fd7ca9e3d33e9895.tar.xz linux-dev-20472af986569b0615bd77f0fd7ca9e3d33e9895.zip | |
[DCCP]: Fix skb leak in dccp_sendmsg
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/dccp/proto.c')
| -rw-r--r-- | net/dccp/proto.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/net/dccp/proto.c b/net/dccp/proto.c index a3f8a8095f81..2b6db18e607f 100644 --- a/net/dccp/proto.c +++ b/net/dccp/proto.c @@ -206,6 +206,18 @@ int dccp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, goto out_discard; rc = dccp_write_xmit(sk, skb, len); + /* + * XXX we don't use sk_write_queue, so just discard the packet. + * Current plan however is to _use_ sk_write_queue with + * an algorith similar to tcp_sendmsg, where the main difference + * is that in DCCP we have to respect packet boundaries, so + * no coalescing of skbs. + * + * This bug was _quickly_ found & fixed by just looking at an OSTRA + * generated callgraph 8) -acme + */ + if (rc != 0) + goto out_discard; out_release: release_sock(sk); return rc ? : len; |