Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c4492586 authored by Wei Yongjun's avatar Wei Yongjun Committed by David S. Miller
Browse files

sctp: Add address type check while process paramaters of ASCONF chunk 



If socket is create by AF_INET type, add IPv6 address to asoc will cause
kernel panic while packet is transmitted on that transport.

This patch add address type check before process paramaters of ASCONF
chunk. If peer is not support this address type, return with error
invald parameter.

Signed-off-by: default avatarWei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: default avatarVlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6e40a915

net/sctp/sm_make_chunk.c

+13 −0
Original line number Original line Diff line number Diff line
@@ -2827,6 +2827,19 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc, 
	union sctp_addr	addr;

	union sctp_addr	addr;

	union sctp_addr_param *addr_param;

	union sctp_addr_param *addr_param;





	switch (addr_param->v4.param_hdr.type) {

	case SCTP_PARAM_IPV6_ADDRESS:

		if (!asoc->peer.ipv6_address)

			return SCTP_ERROR_INV_PARAM;

		break;

	case SCTP_PARAM_IPV4_ADDRESS:

		if (!asoc->peer.ipv4_address)

			return SCTP_ERROR_INV_PARAM;

		break;

	default:

		return SCTP_ERROR_INV_PARAM;

	}



	addr_param = (union sctp_addr_param *)

	addr_param = (union sctp_addr_param *)

			((void *)asconf_param + sizeof(sctp_addip_param_t));

			((void *)asconf_param + sizeof(sctp_addip_param_t));