diff options
| author | David S. Miller <davem@davemloft.net> | 2015-08-28 06:45:31 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-08-28 06:45:31 +0200 |
| commit | 0d36938bb82a7775c21ce0a7429f08ba13d025b6 (patch) | |
| tree | f502caf5555591ee237e14e5fa96b2c005a85036 /net/sctp | |
| parent | Merge branch 'iff_no_queue_fixups' (diff) | |
| parent | Merge tag 'powerpc-4.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/po... (diff) | |
| download | linux-0d36938bb82a7775c21ce0a7429f08ba13d025b6.tar.xz linux-0d36938bb82a7775c21ce0a7429f08ba13d025b6.zip | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Diffstat (limited to 'net/sctp')
| -rw-r--r-- | net/sctp/sm_make_chunk.c | 7 | ||||
| -rw-r--r-- | net/sctp/sm_sideeffect.c | 2 |
2 files changed, 8 insertions, 1 deletions
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c index 06320c8c1c86..a655ddc3f353 100644 --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -3132,11 +3132,18 @@ bool sctp_verify_asconf(const struct sctp_association *asoc, case SCTP_PARAM_IPV4_ADDRESS: if (length != sizeof(sctp_ipv4addr_param_t)) return false; + /* ensure there is only one addr param and it's in the + * beginning of addip_hdr params, or we reject it. + */ + if (param.v != addip->addip_hdr.params) + return false; addr_param_seen = true; break; case SCTP_PARAM_IPV6_ADDRESS: if (length != sizeof(sctp_ipv6addr_param_t)) return false; + if (param.v != addip->addip_hdr.params) + return false; addr_param_seen = true; break; case SCTP_PARAM_ADD_IP: diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c index fef2acdf4a2e..85e6f03aeb70 100644 --- a/net/sctp/sm_sideeffect.c +++ b/net/sctp/sm_sideeffect.c @@ -702,7 +702,7 @@ static void sctp_cmd_transport_on(sctp_cmd_seq_t *cmds, * outstanding data and rely on the retransmission limit be reached * to shutdown the association. */ - if (t->asoc->state != SCTP_STATE_SHUTDOWN_PENDING) + if (t->asoc->state < SCTP_STATE_SHUTDOWN_PENDING) t->asoc->overall_error_count = 0; /* Clear the hb_sent flag to signal that we had a good |