From: Wei Yongjun <yjwei@cn•fujitsu.com>
To: David Miller <davem@davemloft•net>
Cc: "netdev@vger•kernel.org" <netdev@vger•kernel.org>,
lksctp <linux-sctp@vger•kernel.org>
Subject: [PATCH net-next-2.6 1/9] sctp: check parameter value of length in ERROR chunk
Date: Wed, 20 Apr 2011 15:25:40 +0800 [thread overview]
Message-ID: <4DAE8A74.2060106@cn.fujitsu.com> (raw)
In-Reply-To: <4DAE8A27.3040007@cn.fujitsu.com>
From: Shan Wei <shanwei@cn•fujitsu.com>
When an endpoint receives ERROR that parameter value is invalid,
send an ABORT to peer with a Protocol Violation error code.
Signed-off-by: Shan Wei <shanwei@cn•fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp•com>
Signed-off-by: Wei Yongjun <yjwei@cn•fujitsu.com>
---
net/sctp/sm_statefuns.c | 5 +++++
1 files changed, 5 insertions(+), 0 deletions(-)
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index c085472..fe2036d 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3204,6 +3204,7 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
sctp_cmd_seq_t *commands)
{
struct sctp_chunk *chunk = arg;
+ sctp_errhdr_t *err;
if (!sctp_vtag_verify(chunk, asoc))
return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
@@ -3212,6 +3213,10 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
return sctp_sf_violation_chunklen(ep, asoc, type, arg,
commands);
+ sctp_walk_errors(err, chunk->chunk_hdr);
+ if ((void *)err != (void *)chunk->chunk_end)
+ return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+ (void *)err, commands);
sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
SCTP_CHUNK(chunk));
--
1.6.5.2
next prev parent reply other threads:[~2011-04-20 7:25 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-04-20 7:24 [PATCH net-next-2.6 0/9] SCTP updates for net-next-2.6 Wei Yongjun
2011-04-20 7:25 ` Wei Yongjun [this message]
2011-04-20 7:26 ` [PATCH net-next-2.6 2/9] sctp: check invalid value of length parameter in error cause Wei Yongjun
2011-04-20 7:27 ` [PATCH net-next-2.6 3/9] sctp: remove redundant check when walking through a list of TLV parameters Wei Yongjun
2011-04-20 7:28 ` [PATCH net-next-2.6 4/9] sctp: remove completely unsed EMPTY state Wei Yongjun
2011-04-20 7:29 ` [PATCH net-next-2.6 5/9] sctp: bail from sctp_endpoint_lookup_assoc() if not bound Wei Yongjun
2011-04-20 7:30 ` [PATCH net-next-2.6 6/9] sctp: handle ootb packet in chunk order as defined Wei Yongjun
2011-04-20 7:30 ` [PATCH net-next-2.6 7/9] sctp: fix to check the source address of COOKIE-ECHO chunk Wei Yongjun
2011-04-20 7:31 ` [PATCH net-next-2.6 8/9] sctp: make heartbeat information in sctp_make_heartbeat() Wei Yongjun
2011-04-20 7:32 ` [PATCH net-next-2.6 9/9] sctp: move chunk from retransmit queue to abandoned list Wei Yongjun
2011-04-20 8:55 ` [PATCH net-next-2.6 0/9] SCTP updates for net-next-2.6 David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4DAE8A74.2060106@cn.fujitsu.com \
--to=yjwei@cn$(echo .)fujitsu.com \
--cc=davem@davemloft$(echo .)net \
--cc=linux-sctp@vger$(echo .)kernel.org \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox