Xin Long 6b84202c94 sctp: fix the check for _sctp_walk_params and _sctp_walk_errors ... Commit b1f5bfc27a ("sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}()") tried to fix the issue that it may overstep the chunk end for _sctp_walk_{params, errors} with 'chunk_end > offset(length) + sizeof(length)'. But it introduced a side effect: When processing INIT, it verifies the chunks with 'param.v == chunk_end' after iterating all params by sctp_walk_params(). With the check 'chunk_end > offset(length) + sizeof(length)', it would return when the last param is not yet accessed. Because the last param usually is fwdtsn supported param whose size is 4 and 'chunk_end == offset(length) + sizeof(length)' This is a badly issue even causing sctp couldn't process 4-shakes. Client would always get abort when connecting to server, due to the failure of INIT chunk verification on server. The patch is to use 'chunk_end <= offset(length) + sizeof(length)' instead of 'chunk_end < offset(length) + sizeof(length)' for both _sctp_walk_params and _sctp_walk_errors. Fixes: b1f5bfc27a ("sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}()") Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-07-27 00:03:12 -07:00
..
auth.h	net, sctp: convert sctp_auth_bytes.refcnt from atomic_t to refcount_t	2017-07-04 22:35:18 +01:00
checksum.h
command.h	sctp: remove the typedef sctp_init_chunk_t	2017-07-01 09:08:42 -07:00
constants.h	sctp: remove the typedef sctp_data_chunk_t	2017-07-01 09:08:42 -07:00
sctp.h	sctp: fix the check for _sctp_walk_params and _sctp_walk_errors	2017-07-27 00:03:12 -07:00
sm.h	sctp: remove the typedef sctp_data_chunk_t	2017-07-01 09:08:42 -07:00
structs.h	net, sctp: convert sctp_ep_common.refcnt from atomic_t to refcount_t	2017-07-04 22:35:19 +01:00
tsnmap.h
ulpevent.h	sctp: add support for generating add stream change event notification	2017-03-12 23:22:23 -07:00
ulpqueue.h