Commit cf2e3942 authored by Julian Anastasov's avatar Julian Anastasov Committed by Simon Horman
Browse files

ipvs: fix sctp chunk length order



Fix wrong but non-fatal access to chunk length.
sch->length should be in network order, next chunk should
be aligned to 4 bytes. Problem noticed in sparse output.
Signed-off-by: default avatarJulian Anastasov <ja@ssi.bg>
Signed-off-by: default avatarSimon Horman <horms@verge.net.au>
parent a82783c9
...@@ -906,7 +906,7 @@ set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp, ...@@ -906,7 +906,7 @@ set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp,
sctp_chunkhdr_t _sctpch, *sch; sctp_chunkhdr_t _sctpch, *sch;
unsigned char chunk_type; unsigned char chunk_type;
int event, next_state; int event, next_state;
int ihl; int ihl, cofs;
#ifdef CONFIG_IP_VS_IPV6 #ifdef CONFIG_IP_VS_IPV6
ihl = cp->af == AF_INET ? ip_hdrlen(skb) : sizeof(struct ipv6hdr); ihl = cp->af == AF_INET ? ip_hdrlen(skb) : sizeof(struct ipv6hdr);
...@@ -914,8 +914,8 @@ set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp, ...@@ -914,8 +914,8 @@ set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp,
ihl = ip_hdrlen(skb); ihl = ip_hdrlen(skb);
#endif #endif
sch = skb_header_pointer(skb, ihl + sizeof(sctp_sctphdr_t), cofs = ihl + sizeof(sctp_sctphdr_t);
sizeof(_sctpch), &_sctpch); sch = skb_header_pointer(skb, cofs, sizeof(_sctpch), &_sctpch);
if (sch == NULL) if (sch == NULL)
return; return;
...@@ -933,10 +933,12 @@ set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp, ...@@ -933,10 +933,12 @@ set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp,
*/ */
if ((sch->type == SCTP_CID_COOKIE_ECHO) || if ((sch->type == SCTP_CID_COOKIE_ECHO) ||
(sch->type == SCTP_CID_COOKIE_ACK)) { (sch->type == SCTP_CID_COOKIE_ACK)) {
sch = skb_header_pointer(skb, (ihl + sizeof(sctp_sctphdr_t) + int clen = ntohs(sch->length);
sch->length), sizeof(_sctpch), &_sctpch);
if (sch) { if (clen >= sizeof(sctp_chunkhdr_t)) {
if (sch->type == SCTP_CID_ABORT) sch = skb_header_pointer(skb, cofs + ALIGN(clen, 4),
sizeof(_sctpch), &_sctpch);
if (sch && sch->type == SCTP_CID_ABORT)
chunk_type = sch->type; chunk_type = sch->type;
} }
} }
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment