Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e15e067d authored by David S. Miller's avatar David S. Miller
Browse files

sctp: Fix SKB list traversal in sctp_intl_store_ordered(). 



Same change as made to sctp_intl_store_reasm().

To be fully correct, an iterator has an undefined value when something
like skb_queue_walk() naturally terminates.

This will actually matter when SKB queues are converted over to
list_head.

Formalize what this code ends up doing with the current
implementation.

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 348bbc25

net/sctp/stream_interleave.c

+12 −5
Original line number Diff line number Diff line
@@ -390,7 +390,7 @@ static void sctp_intl_store_ordered(struct sctp_ulpq *ulpq, 
				    struct sctp_ulpevent *event)

{

	struct sctp_ulpevent *cevent;

	struct sk_buff *pos;

	struct sk_buff *pos, *loc;



	pos = skb_peek_tail(&ulpq->lobby);

	if (!pos) {
@@ -410,18 +410,25 @@ static void sctp_intl_store_ordered(struct sctp_ulpq *ulpq, 
		return;

	}



	loc = NULL;

	skb_queue_walk(&ulpq->lobby, pos) {

		cevent = (struct sctp_ulpevent *)pos->cb;



		if (cevent->stream > event->stream)

		if (cevent->stream > event->stream) {

			loc = pos;

			break;



		}

		if (cevent->stream == event->stream &&

		    MID_lt(event->mid, cevent->mid))

		    MID_lt(event->mid, cevent->mid)) {

			loc = pos;

			break;

		}

	}



	__skb_queue_before(&ulpq->lobby, pos, sctp_event2skb(event));

	if (!loc)

		__skb_queue_tail(&ulpq->lobby, sctp_event2skb(event));

	else

		__skb_queue_before(&ulpq->lobby, loc, sctp_event2skb(event));

}



static void sctp_intl_retrieve_ordered(struct sctp_ulpq *ulpq,