[SCTP]: Fix panic's when receiving fragmented SCTP control chunks.
Use pskb_pull() to handle incoming COOKIE_ECHO and HEARTBEAT chunks that are received as skb's with fragment list. Signed-off-by: Sridhar Samudrala <sri@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
672e7cca17
commit
62b08083ec
|
@ -636,8 +636,9 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep,
|
||||||
*/
|
*/
|
||||||
chunk->subh.cookie_hdr =
|
chunk->subh.cookie_hdr =
|
||||||
(struct sctp_signed_cookie *)chunk->skb->data;
|
(struct sctp_signed_cookie *)chunk->skb->data;
|
||||||
skb_pull(chunk->skb,
|
if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
|
||||||
ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t));
|
sizeof(sctp_chunkhdr_t)))
|
||||||
|
goto nomem;
|
||||||
|
|
||||||
/* 5.1 D) Upon reception of the COOKIE ECHO chunk, Endpoint
|
/* 5.1 D) Upon reception of the COOKIE ECHO chunk, Endpoint
|
||||||
* "Z" will reply with a COOKIE ACK chunk after building a TCB
|
* "Z" will reply with a COOKIE ACK chunk after building a TCB
|
||||||
|
@ -965,7 +966,8 @@ sctp_disposition_t sctp_sf_beat_8_3(const struct sctp_endpoint *ep,
|
||||||
*/
|
*/
|
||||||
chunk->subh.hb_hdr = (sctp_heartbeathdr_t *) chunk->skb->data;
|
chunk->subh.hb_hdr = (sctp_heartbeathdr_t *) chunk->skb->data;
|
||||||
paylen = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t);
|
paylen = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t);
|
||||||
skb_pull(chunk->skb, paylen);
|
if (!pskb_pull(chunk->skb, paylen))
|
||||||
|
goto nomem;
|
||||||
|
|
||||||
reply = sctp_make_heartbeat_ack(asoc, chunk,
|
reply = sctp_make_heartbeat_ack(asoc, chunk,
|
||||||
chunk->subh.hb_hdr, paylen);
|
chunk->subh.hb_hdr, paylen);
|
||||||
|
@ -1860,8 +1862,9 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(const struct sctp_endpoint *ep,
|
||||||
* are in good shape.
|
* are in good shape.
|
||||||
*/
|
*/
|
||||||
chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
|
chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data;
|
||||||
skb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
|
if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) -
|
||||||
sizeof(sctp_chunkhdr_t));
|
sizeof(sctp_chunkhdr_t)))
|
||||||
|
goto nomem;
|
||||||
|
|
||||||
/* In RFC 2960 5.2.4 3, if both Verification Tags in the State Cookie
|
/* In RFC 2960 5.2.4 3, if both Verification Tags in the State Cookie
|
||||||
* of a duplicate COOKIE ECHO match the Verification Tags of the
|
* of a duplicate COOKIE ECHO match the Verification Tags of the
|
||||||
|
|
Loading…
Reference in a new issue