Commit c615c9f3 authored Jul 02, 2009 by Wei Yongjun Committed by David S. Miller Jul 03, 2009

xfrm4: fix the ports decode of sctp protocol



The SCTP pushed the skb data above the sctp chunk header, so the check
of pskb_may_pull(skb, xprth + 4 - skb->data) in _decode_session4() will
never return 0 because xprth + 4 - skb->data < 0, the ports decode of
sctp will always fail.

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 15da4b16

net/ipv4/xfrm4_policy.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -136,7 +136,8 @@ _decode_session4(struct sk_buff skb, struct flowi fl, int reverse)
		case IPPROTO_TCP:
		case IPPROTO_SCTP:
		case IPPROTO_DCCP:
		if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
		if (xprth + 4 < skb->data \|\|
		pskb_may_pull(skb, xprth + 4 - skb->data)) {
		__be16 ports = (__be16 )xprth;

		fl->fl_ip_sport = ports[!!reverse];