sctp: Call inet6_destroy_sock() via sk->sk_destruct().

commit 6431b0f6ff1633ae598667e4cdd93830074a03e8 upstream.

After commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock()
in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in
sk->sk_destruct() by setting inet6_sock_destruct() to it to make
sure we do not leak inet6-specific resources.

SCTP sets its own sk->sk_destruct() in the sctp_init_sock(), and
SCTPv6 socket reuses it as the init function.

To call inet6_sock_destruct() from SCTPv6 sk->sk_destruct(), we
set sctp_v6_destruct_sock() in a new init function.

Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 507b2ad5ef7c71ac6bb332c1e3314e1ddd7a4ad1..17185200079d59ae41e04fd2c82debf4b8f3e0e6 100644 (file)
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5102,13 +5102,17 @@ static void sctp_destroy_sock(struct sock *sk)
 }
 
 /* Triggered when there are no references on the socket anymore */
-static void sctp_destruct_sock(struct sock *sk)
+static void sctp_destruct_common(struct sock *sk)
 {
        struct sctp_sock *sp = sctp_sk(sk);
 
        /* Free up the HMAC transform. */
        crypto_free_shash(sp->hmac);
+}
 
+static void sctp_destruct_sock(struct sock *sk)
+{
+       sctp_destruct_common(sk);
        inet_sock_destruct(sk);
 }
 
@@ -9431,7 +9435,7 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
        sctp_sk(newsk)->reuse = sp->reuse;
 
        newsk->sk_shutdown = sk->sk_shutdown;
-       newsk->sk_destruct = sctp_destruct_sock;
+       newsk->sk_destruct = sk->sk_destruct;
        newsk->sk_family = sk->sk_family;
        newsk->sk_protocol = IPPROTO_SCTP;
        newsk->sk_backlog_rcv = sk->sk_prot->backlog_rcv;
@@ -9666,11 +9670,20 @@ struct proto sctp_prot = {
 
 #if IS_ENABLED(CONFIG_IPV6)
 
-#include <net/transp_v6.h>
-static void sctp_v6_destroy_sock(struct sock *sk)
+static void sctp_v6_destruct_sock(struct sock *sk)
+{
+       sctp_destruct_common(sk);
+       inet6_sock_destruct(sk);
+}
+
+static int sctp_v6_init_sock(struct sock *sk)
 {
-       sctp_destroy_sock(sk);
-       inet6_destroy_sock(sk);
+       int ret = sctp_init_sock(sk);
+
+       if (!ret)
+               sk->sk_destruct = sctp_v6_destruct_sock;
+
+       return ret;
 }
 
 struct proto sctpv6_prot = {
@@ -9680,8 +9693,8 @@ struct proto sctpv6_prot = {
        .disconnect     = sctp_disconnect,
        .accept         = sctp_accept,
        .ioctl          = sctp_ioctl,
-       .init           = sctp_init_sock,
-       .destroy        = sctp_v6_destroy_sock,
+       .init           = sctp_v6_init_sock,
+       .destroy        = sctp_destroy_sock,
        .shutdown       = sctp_shutdown,
        .setsockopt     = sctp_setsockopt,
        .getsockopt     = sctp_getsockopt,