Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cf2e3942 authored by Julian Anastasov's avatar Julian Anastasov Committed by Simon Horman
Browse files

ipvs: fix sctp chunk length order 



Fix wrong but non-fatal access to chunk length.
sch->length should be in network order, next chunk should
be aligned to 4 bytes. Problem noticed in sparse output.

Signed-off-by: default avatarJulian Anastasov <ja@ssi.bg>
Signed-off-by: default avatarSimon Horman <horms@verge.net.au>
parent a82783c9

net/netfilter/ipvs/ip_vs_proto_sctp.c

+9 −7
Original line number Original line Diff line number Diff line
@@ -906,7 +906,7 @@ set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp, 
	sctp_chunkhdr_t _sctpch, *sch;

	sctp_chunkhdr_t _sctpch, *sch;

	unsigned char chunk_type;

	unsigned char chunk_type;

	int event, next_state;

	int event, next_state;

	int ihl;

	int ihl, cofs;





#ifdef CONFIG_IP_VS_IPV6

#ifdef CONFIG_IP_VS_IPV6

	ihl = cp->af == AF_INET ? ip_hdrlen(skb) : sizeof(struct ipv6hdr);

	ihl = cp->af == AF_INET ? ip_hdrlen(skb) : sizeof(struct ipv6hdr);
@@ -914,8 +914,8 @@ set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp, 
	ihl = ip_hdrlen(skb);

	ihl = ip_hdrlen(skb);

#endif

#endif





	sch = skb_header_pointer(skb, ihl + sizeof(sctp_sctphdr_t),

	cofs = ihl + sizeof(sctp_sctphdr_t);

				sizeof(_sctpch), &_sctpch);

	sch = skb_header_pointer(skb, cofs, sizeof(_sctpch), &_sctpch);

	if (sch == NULL)

	if (sch == NULL)

		return;

		return;
@@ -933,10 +933,12 @@ set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp, 
	 */

	 */

	if ((sch->type == SCTP_CID_COOKIE_ECHO) ||

	if ((sch->type == SCTP_CID_COOKIE_ECHO) ||

	    (sch->type == SCTP_CID_COOKIE_ACK)) {

	    (sch->type == SCTP_CID_COOKIE_ACK)) {

		sch = skb_header_pointer(skb, (ihl + sizeof(sctp_sctphdr_t) +

		int clen = ntohs(sch->length);

				sch->length), sizeof(_sctpch), &_sctpch);



		if (sch) {

		if (clen >= sizeof(sctp_chunkhdr_t)) {

			if (sch->type == SCTP_CID_ABORT)

			sch = skb_header_pointer(skb, cofs + ALIGN(clen, 4),

						 sizeof(_sctpch), &_sctpch);

			if (sch && sch->type == SCTP_CID_ABORT)

				chunk_type = sch->type;

				chunk_type = sch->type;

		}

		}

	}

	}