Commit 804ec7eb authored by Davide Caratti's avatar Davide Caratti Committed by David S. Miller

sctp: fix ICMP processing if skb is non-linear

sometimes ICMP replies to INIT chunks are ignored by the client, even if
the encapsulated SCTP headers match an open socket. This happens when the
ICMP packet is carried by a paged skb: use skb_header_pointer() to read
packet contents beyond the SCTP header, so that chunk header and initiate
tag are validated correctly.

v2:
- don't use skb_header_pointer() to read the transport header, since
  icmp_socket_deliver() already puts these 8 bytes in the linear area.
- change commit message to make specific reference to INIT chunks.
Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: default avatarVlad Yasevich <vyasevich@gmail.com>
Reviewed-by: default avatarXin Long <lucien.xin@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0908cf4d
...@@ -473,15 +473,14 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb, ...@@ -473,15 +473,14 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
struct sctp_association **app, struct sctp_association **app,
struct sctp_transport **tpp) struct sctp_transport **tpp)
{ {
struct sctp_init_chunk *chunkhdr, _chunkhdr;
union sctp_addr saddr; union sctp_addr saddr;
union sctp_addr daddr; union sctp_addr daddr;
struct sctp_af *af; struct sctp_af *af;
struct sock *sk = NULL; struct sock *sk = NULL;
struct sctp_association *asoc; struct sctp_association *asoc;
struct sctp_transport *transport = NULL; struct sctp_transport *transport = NULL;
struct sctp_init_chunk *chunkhdr;
__u32 vtag = ntohl(sctphdr->vtag); __u32 vtag = ntohl(sctphdr->vtag);
int len = skb->len - ((void *)sctphdr - (void *)skb->data);
*app = NULL; *tpp = NULL; *app = NULL; *tpp = NULL;
...@@ -516,13 +515,16 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb, ...@@ -516,13 +515,16 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
* discard the packet. * discard the packet.
*/ */
if (vtag == 0) { if (vtag == 0) {
chunkhdr = (void *)sctphdr + sizeof(struct sctphdr); /* chunk header + first 4 octects of init header */
if (len < sizeof(struct sctphdr) + sizeof(sctp_chunkhdr_t) chunkhdr = skb_header_pointer(skb, skb_transport_offset(skb) +
+ sizeof(__be32) || sizeof(struct sctphdr),
sizeof(struct sctp_chunkhdr) +
sizeof(__be32), &_chunkhdr);
if (!chunkhdr ||
chunkhdr->chunk_hdr.type != SCTP_CID_INIT || chunkhdr->chunk_hdr.type != SCTP_CID_INIT ||
ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag) { ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag)
goto out; goto out;
}
} else if (vtag != asoc->c.peer_vtag) { } else if (vtag != asoc->c.peer_vtag) {
goto out; goto out;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment