| From 2e3219b5c8a2e44e0b83ae6e04f52f20a82ac0f2 Mon Sep 17 00:00:00 2001 |
| From: Wei Yongjun <yjwei@cn.fujitsu.com> |
| Date: Mon, 17 May 2010 22:51:58 -0700 |
| Subject: sctp: fix append error cause to ERROR chunk correctly |
| |
| From: Wei Yongjun <yjwei@cn.fujitsu.com> |
| |
| commit 2e3219b5c8a2e44e0b83ae6e04f52f20a82ac0f2 upstream. |
| |
| commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809 |
| sctp: Fix skb_over_panic resulting from multiple invalid \ |
| parameter errors (CVE-2010-1173) (v4) |
| |
| cause 'error cause' never be add the the ERROR chunk due to |
| some typo when check valid length in sctp_init_cause_fixed(). |
| |
| Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> |
| Reviewed-by: Neil Horman <nhorman@tuxdriver.com> |
| Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| net/sctp/sm_make_chunk.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/net/sctp/sm_make_chunk.c |
| +++ b/net/sctp/sm_make_chunk.c |
| @@ -140,7 +140,7 @@ int sctp_init_cause_fixed(struct sctp_ch |
| len = sizeof(sctp_errhdr_t) + paylen; |
| err.length = htons(len); |
| |
| - if (skb_tailroom(chunk->skb) > len) |
| + if (skb_tailroom(chunk->skb) < len) |
| return -ENOSPC; |
| chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk, |
| sizeof(sctp_errhdr_t), |
| @@ -1412,7 +1412,7 @@ void *sctp_addto_chunk(struct sctp_chunk |
| void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk, |
| int len, const void *data) |
| { |
| - if (skb_tailroom(chunk->skb) > len) |
| + if (skb_tailroom(chunk->skb) >= len) |
| return sctp_addto_chunk(chunk, len, data); |
| else |
| return NULL; |
