Xin Long 8b02e19ec3 sctp: fix the check for _sctp_walk_params and _sctp_walk_errors ... commit 6b84202c946cd3da3a8daa92c682510e9ed80321 upstream. Commit b1f5bfc27a19 ("sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}()") tried to fix the issue that it may overstep the chunk end for _sctp_walk_{params, errors} with 'chunk_end > offset(length) + sizeof(length)'. But it introduced a side effect: When processing INIT, it verifies the chunks with 'param.v == chunk_end' after iterating all params by sctp_walk_params(). With the check 'chunk_end > offset(length) + sizeof(length)', it would return when the last param is not yet accessed. Because the last param usually is fwdtsn supported param whose size is 4 and 'chunk_end == offset(length) + sizeof(length)' This is a badly issue even causing sctp couldn't process 4-shakes. Client would always get abort when connecting to server, due to the failure of INIT chunk verification on server. The patch is to use 'chunk_end <= offset(length) + sizeof(length)' instead of 'chunk_end < offset(length) + sizeof(length)' for both _sctp_walk_params and _sctp_walk_errors. Fixes: b1f5bfc27a19 ("sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}()") Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Willy Tarreau <w@1wt.eu>		2019-07-27 21:44:27 +02:00
..
9p	9p: turn fid->dlist into hlist	2013-02-27 22:51:08 -05:00
bluetooth	Bluetooth: Return the correct address type for L2CAP sockets	2015-04-20 13:26:42 +05:30
caif	caif: Remove my bouncing email address.	2013-04-23 13:25:51 -04:00
irda	irda: small read past the end of array in debug code	2013-04-19 17:32:31 -04:00
iucv	af_iucv: fix recvmsg by replacing skb_pull() function	2013-04-08 17:16:57 -04:00
netfilter	netfilter: Changes to handle segmentation in SIP ALG	2015-01-27 15:47:39 -08:00
netns	Merge remote-tracking branch 'f2fs/linux-3.10.y' into HEAD	2017-04-18 17:02:28 +02:00
nfc	NFC: RFKILL support	2013-04-12 16:54:45 +02:00
phonet
sctp	sctp: fix the check for _sctp_walk_params and _sctp_walk_errors	2019-07-27 21:44:27 +02:00
tc_act
act_api.h	act_police: move struct tcf_police to act_police.c	2013-02-12 18:59:45 -05:00
activity_stats.h	net: activity_stats: Add statistics for network transmission activity	2013-07-01 13:40:29 -07:00
addrconf.h	ipv6: clean up anycast when an interface is destroyed	2015-03-19 15:00:11 -07:00
af_ieee802154.h
af_rxrpc.h
af_unix.h	This is the 3.10.99 stable release	2017-04-18 17:17:46 +02:00
ah.h
arp.h
atmclip.h
ax25.h	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
ax88796.h
cfg80211-wext.h
cfg80211.h	cfg80211: Define macro to indicate support for cfg80211 abort scan api	2016-10-07 18:11:15 +05:30
checksum.h
cipso_ipv4.h	netlabel: out of bound access in cipso_v4_validate()	2019-07-27 21:43:04 +02:00
cls_cgroup.h	cls_cgroup: remove task_struct parameter from sock_update_classid()	2013-04-09 13:19:35 -04:00
cnss.h	net: cnss: refactor PM QoS request wrapper API	2016-08-10 18:36:16 +05:30
cnss_prealloc.h	Import latest Samsung release	2017-04-18 03:43:52 +02:00
codel.h
compat.h
datalink.h
dcbevent.h
dcbnl.h
dn.h
dn_dev.h
dn_fib.h	decnet: Parse netlink attributes on our own	2013-03-22 10:31:16 -04:00
dn_neigh.h
dn_nsp.h
dn_route.h
dsa.h
dsfield.h
dst.h	net: dst: provide accessor function to dst->xfrm	2013-11-04 04:31:03 -08:00
dst_ops.h
esp.h
ethoc.h
fib_rules.h	net: core: Support UID-based routing.	2014-11-04 13:06:30 -08:00
firewire.h	firewire net, ipv4 arp: Extend hardware address and remove driver-level packet inspection.	2013-03-26 12:32:13 -04:00
flow.h	ipv4, fib: pass LOOPBACK_IFINDEX instead of 0 to flowi4_iif	2015-09-16 18:20:08 +05:30
flow_keys.h	flow_keys: include thoff into flow_keys for later usage	2013-03-20 12:14:36 -04:00
garp.h
gen_stats.h
genetlink.h	genl: Hold reference on correct module while netlink-dump.	2013-09-14 06:54:55 -07:00
gre.h	GRE: Refactor GRE tunneling code.	2013-03-26 12:27:18 -04:00
gro_cells.h
icmp.h	ipv4: fix error handling in icmp_protocol.	2013-02-22 15:10:18 -05:00
ieee80211_radiotap.h
ieee802154.h
ieee802154_netdev.h	ieee802154/nl-mac.c: make some MLME operations optional	2013-04-08 12:00:16 -04:00
if_inet6.h	ipv6: move DAD and addrconf_verify processing to workqueue	2019-07-27 21:42:27 +02:00
inet6_connection_sock.h
inet6_hashtables.h	ipv6: use a stronger hash for tcp	2013-02-21 18:15:58 -05:00
inet_common.h	net: avoid NULL deref in inet_ctl_sock_destroy()	2015-12-09 13:40:06 -05:00
inet_connection_sock.h	tcp: fix tcp_release_cb() to dispatch via address family for mtu_reduced()	2014-10-15 08:31:56 +02:00
inet_ecn.h
inet_frag.h	net: frag, fix race conditions in LRU list maintenance	2013-05-06 11:06:51 -04:00
inet_hashtables.h	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
inet_sock.h	net: support marking accepting TCP sockets	2014-06-23 15:21:22 -07:00
inet_timewait_sock.h	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
inetpeer.h	inetpeer: get rid of ip_id_count	2014-08-14 09:24:15 +08:00
ip.h	Merge remote-tracking branch 'f2fs/linux-3.10.y' into HEAD	2017-04-18 17:02:28 +02:00
ip6_checksum.h
ip6_fib.h	ipv6: prevent fib6_run_gc() contention	2015-07-03 19:48:09 -07:00
ip6_route.h	ipv6: Limit mtu to 65575 bytes	2014-05-30 21:52:14 -07:00
ip6_tunnel.h	ip6_tunnel: Clear IP6CB in ip6tunnel_xmit()	2019-07-27 21:42:30 +02:00
ip_fib.h	ipv4: fix definition of FIB_TABLE_HASHSZ	2013-03-13 10:47:09 -04:00
ip_tunnels.h	ip_gre: Fix WCCPv2 header parsing.	2013-11-20 12:27:46 -08:00
ip_vs.h	arch: Mass conversion of smp_mb__*()	2014-08-15 11:45:28 -07:00
ipcomp.h
ipconfig.h
ipv6.h	This is the 3.10.95 stable release	2017-04-18 17:14:54 +02:00
ipx.h
iw_handler.h	wext: handle NULL extra data in iwe_stream_add_point better	2019-07-27 21:44:25 +02:00
lapb.h
lib80211.h	hostap: Don't use create_proc_read_entry()	2013-04-29 15:41:56 -04:00
llc.h
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc_if.h
llc_pdu.h
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
mac80211.h	mac80211: add a flag to indicate CCK support for HT clients	2013-09-07 22:09:59 -07:00
mac802154.h
mip6.h
mld.h
mrp.h	net/802: Implement Multiple Registration Protocol (MRP)	2013-02-10 20:37:22 -05:00
ndisc.h	ipv6: don't call fib6_run_gc() until routing is ready	2019-07-27 21:42:27 +02:00
neighbour.h	net neighbour, decnet: Ensure to align device private data on preferred alignment.	2013-02-11 00:21:44 -05:00
net_namespace.h	ipv4, fib: pass LOOPBACK_IFINDEX instead of 0 to flowi4_iif	2015-09-16 18:20:08 +05:30
net_ratelimit.h
netdma.h
netevent.h
netlabel.h
netlink.h
netprio_cgroup.h	netprio_cgroup: remove task_struct parameter from sock_update_netprio()	2013-04-09 13:19:37 -04:00
netrom.h	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
nexthop.h
nl802154.h
p8022.h
ping.h	net: ipv6: Add IPv6 support to the ping socket.	2014-05-06 09:18:35 -06:00
pkt_cls.h
pkt_sched.h	net: tc_qdisc_flow_control returning qdisc size	2014-05-29 11:20:36 -06:00
protocol.h
psnap.h
raw.h
rawv6.h
red.h
regulatory.h
request_sock.h	net: remove a stale comment for dl_next	2013-04-22 15:55:48 -04:00
rose.h
route.h	Handle 'sk' being NULL in UID-based routing.	2014-11-04 13:08:33 -08:00
rtnetlink.h	rtnetlink: Remove passing of attributes into rtnl_doit functions	2013-03-22 10:31:16 -04:00
sch_generic.h	net_sched: restore "linklayer atm" handling	2013-09-14 06:54:55 -07:00
scm.h	Import latest Samsung release	2017-04-18 03:43:52 +02:00
secure_seq.h	inetpeer: get rid of ip_id_count	2014-08-14 09:24:15 +08:00
slhc_vj.h
snmp.h
sock.h	net: avoid sk_forward_alloc overflows	2019-07-27 21:42:37 +02:00
stp.h
tcp.h	tcp: introduce tcp_rto_delta_us() helper for xmit timer fix	2019-07-27 21:44:11 +02:00
tcp_memcontrol.h
tcp_states.h
timewait_sock.h
transp_v6.h	net: ipv6: Add IPv6 support to the ping socket.	2014-05-06 09:18:35 -06:00
udp.h	ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET pending data	2013-07-28 16:29:49 -07:00
udplite.h
wext.h
wimax.h
wpan-phy.h
x25.h
x25device.h
xfrm.h	xfrm: force a garbage collection after deleting a policy	2013-05-31 17:30:07 -07:00