From: Herbert Xu Date: Mon, 30 Oct 2006 07:46:42 +0000 (-0800) Subject: [SCTP]: Always linearise packet on input X-Git-Tag: v2.6.19-rc5~101^2~12 X-Git-Url: http://git.rot13.org/?a=commitdiff_plain;h=28cd7752734563d5b0967b96a6bade7a1dc89c7f;p=powerpc.git [SCTP]: Always linearise packet on input I was looking at a RHEL5 bug report involving Xen and SCTP (https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212550). It turns out that SCTP wasn't written to handle skb fragments at all. The absence of any calls to skb_may_pull is testament to that. It just so happens that Xen creates fragmented packets more often than other scenarios (header & data split when going from domU to dom0). That's what caused this bug to show up. Until someone has the time sits down and audits the entire net/sctp directory, here is a conservative and safe solution that simply linearises all packets on input. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller --- diff --git a/net/sctp/input.c b/net/sctp/input.c index 64f6301025..99c0501ca5 100644 --- a/net/sctp/input.c +++ b/net/sctp/input.c @@ -135,6 +135,9 @@ int sctp_rcv(struct sk_buff *skb) SCTP_INC_STATS_BH(SCTP_MIB_INSCTPPACKS); + if (skb_linearize(skb)) + goto discard_it; + sh = (struct sctphdr *) skb->h.raw; /* Pull up the IP and SCTP headers. */