sctp: fix ICMP processing if skb is non-linear
authorDavide Caratti <dcaratti@redhat.com>
Thu, 25 May 2017 17:14:56 +0000 (19:14 +0200)
committerRaspbian kernel package updater <root@raspbian.org>
Sun, 23 Jul 2017 02:52:19 +0000 (02:52 +0000)
commite6df3230afb20f540026ed8192ae680636012605
treed3eea9003d4b02f960e2b41d46f583e3df324cf3
parent6713978bfc711513defefe8916edf760cbfbef4e
sctp: fix ICMP processing if skb is non-linear

[ Upstream commit 804ec7ebe8ea003999ca8d1bfc499edc6a9e07df ]

sometimes ICMP replies to INIT chunks are ignored by the client, even if
the encapsulated SCTP headers match an open socket. This happens when the
ICMP packet is carried by a paged skb: use skb_header_pointer() to read
packet contents beyond the SCTP header, so that chunk header and initiate
tag are validated correctly.

v2:
- don't use skb_header_pointer() to read the transport header, since
  icmp_socket_deliver() already puts these 8 bytes in the linear area.
- change commit message to make specific reference to INIT chunks.

Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/sctp/input.c