diff options
| author | Sridhar Samudrala <sri@us.ibm.com> | 2005-07-18 22:44:10 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2005-07-18 22:44:10 +0200 |
| commit | d1ad1ff299dd908d07c5e5f27f88bbdb235eb7a5 (patch) | |
| tree | 03f66679f4a153ec06fde913907f392503f4b5e5 /net/sctp/ipv6.c | |
| parent | [SCTP]: Audit return code of create_proc_* (diff) | |
| download | linux-d1ad1ff299dd908d07c5e5f27f88bbdb235eb7a5.tar.xz linux-d1ad1ff299dd908d07c5e5f27f88bbdb235eb7a5.zip | |
[SCTP]: Fix potential null pointer dereference while handling an icmp error
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to '')
| -rw-r--r-- | net/sctp/ipv6.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c index c7e42d125b9c..e9b2fd480d61 100644 --- a/net/sctp/ipv6.c +++ b/net/sctp/ipv6.c @@ -91,7 +91,6 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, struct ipv6hdr *iph = (struct ipv6hdr *)skb->data; struct sctphdr *sh = (struct sctphdr *)(skb->data + offset); struct sock *sk; - struct sctp_endpoint *ep; struct sctp_association *asoc; struct sctp_transport *transport; struct ipv6_pinfo *np; @@ -105,7 +104,7 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, savesctp = skb->h.raw; skb->nh.ipv6h = iph; skb->h.raw = (char *)sh; - sk = sctp_err_lookup(AF_INET6, skb, sh, &ep, &asoc, &transport); + sk = sctp_err_lookup(AF_INET6, skb, sh, &asoc, &transport); /* Put back, the original pointers. */ skb->nh.raw = saveip; skb->h.raw = savesctp; @@ -124,7 +123,7 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, goto out_unlock; case ICMPV6_PARAMPROB: if (ICMPV6_UNK_NEXTHDR == code) { - sctp_icmp_proto_unreachable(sk, ep, asoc, transport); + sctp_icmp_proto_unreachable(sk, asoc, transport); goto out_unlock; } break; @@ -142,7 +141,7 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, } out_unlock: - sctp_err_finish(sk, ep, asoc); + sctp_err_finish(sk, asoc); out: if (likely(idev != NULL)) in6_dev_put(idev); |