Commit 62b08083 authored by Sridhar Samudrala's avatar Sridhar Samudrala Committed by David S. Miller
Browse files

[SCTP]: Fix panic's when receiving fragmented SCTP control chunks. 



Use pskb_pull() to handle incoming COOKIE_ECHO and HEARTBEAT chunks that
are received as skb's with fragment list.

Signed-off-by: default avatarSridhar Samudrala <sri@us.ibm.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 672e7cca

net/sctp/sm_statefuns.c

+8 −5
Original line number Diff line number Diff line
@@ -636,8 +636,9 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep, 
	 */

        chunk->subh.cookie_hdr =

		(struct sctp_signed_cookie *)chunk->skb->data;

	skb_pull(chunk->skb,

		 ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t));

	if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -

					 sizeof(sctp_chunkhdr_t)))

		goto nomem;



	/* 5.1 D) Upon reception of the COOKIE ECHO chunk, Endpoint

	 * "Z" will reply with a COOKIE ACK chunk after building a TCB
@@ -965,7 +966,8 @@ sctp_disposition_t sctp_sf_beat_8_3(const struct sctp_endpoint *ep, 
	 */

	chunk->subh.hb_hdr = (sctp_heartbeathdr_t *) chunk->skb->data;

	paylen = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t);

	skb_pull(chunk->skb, paylen);

	if (!pskb_pull(chunk->skb, paylen))

		goto nomem;



	reply = sctp_make_heartbeat_ack(asoc, chunk,

					chunk->subh.hb_hdr, paylen);
@@ -1860,8 +1862,9 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(const struct sctp_endpoint *ep, 
	 * are in good shape.

	 */

        chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;

	skb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -

		 sizeof(sctp_chunkhdr_t));

	if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -

					sizeof(sctp_chunkhdr_t)))

		goto nomem;



	/* In RFC 2960 5.2.4 3, if both Verification Tags in the State Cookie

	 * of a duplicate COOKIE ECHO match the Verification Tags of the