https://github.com/torvalds/linux
Revision ba0166708ef4da7eeb61dd92bbba4d5a749d6561 authored by Wei Yongjun on 30 September 2008, 12:32:24 UTC, committed by David S. Miller on 30 September 2008, 12:32:24 UTC
Since call to function sctp_sf_abort_violation() need paramter 'arg' with
'struct sctp_chunk' type, it will read the chunk type and chunk length from
the chunk_hdr member of chunk. But call to sctp_sf_violation_paramlen()
always with 'struct sctp_paramhdr' type's parameter, it will be passed to
sctp_sf_abort_violation(). This may cause kernel panic.

   sctp_sf_violation_paramlen()
     |-- sctp_sf_abort_violation()
        |-- sctp_make_abort_violation()

This patch fixed this problem. This patch also fix two place which called
sctp_sf_violation_paramlen() with wrong paramter type.

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 8b122ef
History
Tip revision: ba0166708ef4da7eeb61dd92bbba4d5a749d6561 authored by Wei Yongjun on 30 September 2008, 12:32:24 UTC
sctp: Fix kernel panic while process protocol violation parameter
Tip revision: ba01667
File Mode Size
Documentation
arch
block
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
usr
virt
.gitignore -rw-r--r-- 867 bytes
.mailmap -rw-r--r-- 3.7 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 90.7 KB
Kbuild -rw-r--r-- 2.4 KB
MAINTAINERS -rw-r--r-- 99.5 KB
Makefile -rw-r--r-- 55.4 KB
README -rw-r--r-- 16.5 KB
REPORTING-BUGS -rw-r--r-- 3.1 KB

README

back to top