Commit 96ca468b authored by Shan Wei's avatar Shan Wei Committed by David S. Miller
Browse files

sctp: check invalid value of length parameter in error cause 



RFC4960, section 3.3.7 said:
 If an endpoint receives an ABORT with a format error or no TCB is
 found, it MUST silently discard it.

When an endpoint receives ABORT that parameter value is invalid,
drop it.

Signed-off-by: default avatarShan Wei <shanwei@cn.fujitsu.com>
Signed-off-by: default avatarVlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: default avatarWei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8a00be1c

net/sctp/sm_statefuns.c

+8 −1
Original line number Diff line number Diff line
@@ -2412,8 +2412,15 @@ static sctp_disposition_t __sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep, 


	/* See if we have an error cause code in the chunk.  */

	len = ntohs(chunk->chunk_hdr->length);

	if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))

	if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr)) {



		sctp_errhdr_t *err;

		sctp_walk_errors(err, chunk->chunk_hdr);

		if ((void *)err != (void *)chunk->chunk_end)

			return sctp_sf_pdiscard(ep, asoc, type, arg, commands);



		error = ((sctp_errhdr_t *)chunk->skb->data)->cause;

	}



	sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNRESET));

	/* ASSOC_FAILED will DELETE_TCB. */

CRA Git | Maintained and supported by SUSTech CRA and CCSE