diff options
| author | Max Krummenacher <max.krummenacher@toradex.com> | 2021-10-16 13:04:24 +0200 |
|---|---|---|
| committer | Max Krummenacher <max.krummenacher@toradex.com> | 2021-10-16 13:04:24 +0200 |
| commit | f8e718054f4421d11638e370b933ccc6c77466ed (patch) | |
| tree | 973ff8cb8aed7d8e4da6a194456ddc01c206b7de /net/sctp/input.c | |
| parent | d900385139e5aa8d584dee92c87bb85d0226253e (diff) | |
| parent | 1392fe82d7fba00ba4a8e01968935f2b2085d5a4 (diff) | |
Merge tag 'v4.4.288' into toradex_vf_4.4
This is the 4.4.288 stable release
Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com>
Diffstat (limited to 'net/sctp/input.c')
| -rw-r--r-- | net/sctp/input.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/net/sctp/input.c b/net/sctp/input.c index 9fa89a35afcd..3f0b8aafc21a 100644 --- a/net/sctp/input.c +++ b/net/sctp/input.c @@ -972,7 +972,8 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct net *net, if (!af) continue; - af->from_addr_param(paddr, params.addr, sh->source, 0); + if (!af->from_addr_param(paddr, params.addr, sh->source, 0)) + continue; asoc = __sctp_lookup_association(net, laddr, paddr, &transport); if (asoc) @@ -1008,6 +1009,9 @@ static struct sctp_association *__sctp_rcv_asconf_lookup( union sctp_addr_param *param; union sctp_addr paddr; + if (ntohs(ch->length) < sizeof(*asconf) + sizeof(struct sctp_paramhdr)) + return NULL; + /* Skip over the ADDIP header and find the Address parameter */ param = (union sctp_addr_param *)(asconf + 1); @@ -1015,7 +1019,8 @@ static struct sctp_association *__sctp_rcv_asconf_lookup( if (unlikely(!af)) return NULL; - af->from_addr_param(&paddr, param, peer_port, 0); + if (af->from_addr_param(&paddr, param, peer_port, 0)) + return NULL; return __sctp_lookup_association(net, laddr, &paddr, transportp); } @@ -1086,7 +1091,7 @@ static struct sctp_association *__sctp_rcv_walk_lookup(struct net *net, ch = (sctp_chunkhdr_t *) ch_end; chunk_num++; - } while (ch_end < skb_tail_pointer(skb)); + } while (ch_end + sizeof(*ch) < skb_tail_pointer(skb)); return asoc; } |