aboutsummaryrefslogtreecommitdiff
path: root/net/sctp/inqueue.c
diff options
context:
space:
mode:
authorNeil Horman <nhorman@tuxdriver.com>2006-05-05 17:02:09 -0700
committerChris Wright <chrisw@sous-sol.org>2006-05-09 12:53:21 -0700
commit2e2a2cd09dd7b3fbc99a1879a54090fd6db16f0c (patch)
tree0ec7e0b342f783c4a6ebe9ed083ddec41182041f /net/sctp/inqueue.c
parentcb19baa0bb7a4064e6d0c99e8f479673120a9f28 (diff)
[PATCH] SCTP: Allow spillover of receive buffer to avoid deadlock. (CVE-2006-2275)
This patch fixes a deadlock situation in the receive path by allowing temporary spillover of the receive buffer. - If the chunk we receive has a tsn that immediately follows the ctsn, accept it even if we run out of receive buffer space and renege data with higher TSNs. - Once we accept one chunk in a packet, accept all the remaining chunks even if we run out of receive buffer space. Signed-off-by: Neil Horman <nhorman@tuxdriver.com> Acked-by: Mark Butler <butlerm@middle.net> Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: Sridhar Samudrala <sri@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Diffstat (limited to 'net/sctp/inqueue.c')
-rw-r--r--net/sctp/inqueue.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index 297b8951463..cf0c767d43a 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -149,6 +149,7 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue)
/* This is the first chunk in the packet. */
chunk->singleton = 1;
ch = (sctp_chunkhdr_t *) chunk->skb->data;
+ chunk->data_accepted = 0;
}
chunk->chunk_hdr = ch;