Wei Yongjun 2cab86bee8 sctp: malloc enough room for asconf-ack chunk ... Sometime the ASCONF_ACK parameters can equal to the fourfold of ASCONF parameters, this only happend in some special case: ASCONF parameter is : Unrecognized Parameter (4 bytes) ASCONF_ACK parameter should be: Error Cause Indication parameter (8 bytes header) + Error Cause (4 bytes header) + Unrecognized Parameter (4bytes) Four 4bytes Unrecognized Parameters in ASCONF chunk will cause panic. Pid: 0, comm: swapper Not tainted 2.6.38-next+ #22 Bochs Bochs EIP: 0060:[<c0717eae>] EFLAGS: 00010246 CPU: 0 EIP is at skb_put+0x60/0x70 EAX: 00000077 EBX: c09060e2 ECX: dec1dc30 EDX: c09469c0 ESI: 00000000 EDI: de3c8d40 EBP: dec1dc58 ESP: dec1dc2c DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 Process swapper (pid: 0, ti=dec1c000 task=c09aef20 task.ti=c0980000) Stack: c09469c0 e1894fa4 00000044 00000004 de3c8d00 de3c8d00 de3c8d44 de3c8d40 c09060e2 de25dd80 de3c8d40 dec1dc7c e1894fa4 dec1dcb0 00000040 00000004 00000000 00000800 00000004 00000004 dec1dce0 e1895a2b dec1dcb4 de25d960 Call Trace: [<e1894fa4>] ? sctp_addto_chunk+0x4e/0x89 [sctp] [<e1894fa4>] sctp_addto_chunk+0x4e/0x89 [sctp] [<e1895a2b>] sctp_process_asconf+0x32f/0x3d1 [sctp] [<e188d554>] sctp_sf_do_asconf+0xf8/0x173 [sctp] [<e1890b02>] sctp_do_sm+0xb8/0x159 [sctp] [<e18a2248>] ? sctp_cname+0x0/0x52 [sctp] [<e189392d>] sctp_assoc_bh_rcv+0xac/0xe3 [sctp] [<e1897d76>] sctp_inq_push+0x2d/0x30 [sctp] [<e18a21b2>] sctp_rcv+0x7a7/0x83d [sctp] [<c077a95c>] ? ipv4_confirm+0x118/0x125 [<c073a970>] ? nf_iterate+0x34/0x62 [<c074789d>] ? ip_local_deliver_finish+0x0/0x194 [<c074789d>] ? ip_local_deliver_finish+0x0/0x194 [<c0747992>] ip_local_deliver_finish+0xf5/0x194 [<c074789d>] ? ip_local_deliver_finish+0x0/0x194 [<c0747a6e>] NF_HOOK.clone.1+0x3d/0x44 [<c0747ab3>] ip_local_deliver+0x3e/0x44 [<c074789d>] ? ip_local_deliver_finish+0x0/0x194 [<c074775c>] ip_rcv_finish+0x29f/0x2c7 [<c07474bd>] ? ip_rcv_finish+0x0/0x2c7 [<c0747a6e>] NF_HOOK.clone.1+0x3d/0x44 [<c0747cae>] ip_rcv+0x1f5/0x233 [<c07474bd>] ? ip_rcv_finish+0x0/0x2c7 [<c071dce3>] __netif_receive_skb+0x310/0x336 [<c07221f3>] netif_receive_skb+0x4b/0x51 [<e0a4ed3d>] cp_rx_poll+0x1e7/0x29c [8139cp] [<c072275e>] net_rx_action+0x65/0x13a [<c0445a54>] __do_softirq+0xa1/0x149 [<c04459b3>] ? __do_softirq+0x0/0x149 <IRQ> [<c0445891>] ? irq_exit+0x37/0x72 [<c040a7e9>] ? do_IRQ+0x81/0x95 [<c07b3670>] ? common_interrupt+0x30/0x38 [<c0428058>] ? native_safe_halt+0xa/0xc [<c040f5d7>] ? default_idle+0x58/0x92 [<c0408fb0>] ? cpu_idle+0x96/0xb2 [<c0797989>] ? rest_init+0x5d/0x5f [<c09fd90c>] ? start_kernel+0x34b/0x350 [<c09fd0cb>] ? i386_start_kernel+0xba/0xc1 Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2011-04-01 21:45:51 -07:00
..
associola.c	sctp: several declared/set but unused fixes	2011-03-07 15:51:14 -08:00
auth.c	sctp: Fix out-of-bounds reading in sctp_asoc_get_hmac()	2010-10-03 21:58:49 -07:00
bind_addr.c
chunk.c	net/sctp: Use pr_fmt and pr_<level>	2010-08-26 14:11:48 -07:00
command.c
debug.c
endpointola.c
input.c	sctp: several declared/set but unused fixes	2011-03-07 15:51:14 -08:00
inqueue.c	net/sctp: Use pr_fmt and pr_<level>	2010-08-26 14:11:48 -07:00
ipv6.c	ipv6: Convert to use flowi6 where applicable.	2011-03-12 15:08:54 -08:00
Kconfig
Makefile
objcnt.c	net/sctp: Use pr_fmt and pr_<level>	2010-08-26 14:11:48 -07:00
output.c	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6	2010-09-27 01:03:03 -07:00
outqueue.c	sctp: several declared/set but unused fixes	2011-03-07 15:51:14 -08:00
primitive.c
probe.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6	2010-10-23 11:47:02 -07:00
proc.c
protocol.c	sctp: Pass __GFP_NOWARN to hash table allocation attempts.	2011-03-30 17:51:36 -07:00
sm_make_chunk.c	sctp: malloc enough room for asconf-ack chunk	2011-04-01 21:45:51 -07:00
sm_sideeffect.c	net/sctp: Use pr_fmt and pr_<level>	2010-08-26 14:11:48 -07:00
sm_statefuns.c	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6	2010-09-09 22:27:33 -07:00
sm_statetable.c	net/sctp: Use pr_fmt and pr_<level>	2010-08-26 14:11:48 -07:00
socket.c	sctp: several declared/set but unused fixes	2011-03-07 15:51:14 -08:00
ssnmap.c
sysctl.c	net: avoid limits overflow	2010-11-10 12:12:00 -08:00
transport.c	net/sctp: Use pr_fmt and pr_<level>	2010-08-26 14:11:48 -07:00
tsnmap.c	sctp: fix compile warnings in sctp_tsnmap_num_gabs	2011-02-20 11:10:15 -08:00
ulpevent.c
ulpqueue.c	sctp: several declared/set but unused fixes	2011-03-07 15:51:14 -08:00