Commit ab921f3c authored Aug 19, 2020 by David Laight Committed by David S. Miller Aug 20, 2020

net: sctp: Fix negotiation of the number of data streams.



The number of output and input streams was never being reduced, eg when
processing received INIT or INIT_ACK chunks.
The effect is that DATA chunks can be sent with invalid stream ids
and then discarded by the remote system.

Fixes: 2075e50c ("sctp: convert to genradix")
Signed-off-by: David Laight <david.laight@aculab.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 41506bff

net/sctp/stream.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -88,12 +88,13 @@ static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt,
		int ret;

		if (outcnt <= stream->outcnt)
		return 0;
		goto out;

		ret = genradix_prealloc(&stream->out, outcnt, gfp);
		if (ret)
		return ret;

		out:
		stream->outcnt = outcnt;
		return 0;
		}
		@@ -104,12 +105,13 @@ static int sctp_stream_alloc_in(struct sctp_stream *stream, __u16 incnt,
		int ret;

		if (incnt <= stream->incnt)
		return 0;
		goto out;

		ret = genradix_prealloc(&stream->in, incnt, gfp);
		if (ret)
		return ret;

		out:
		stream->incnt = incnt;
		return 0;
		}