Commit 405426f6ca8ac2d8d5b1f8eb9285452d44222781

Authored by Daniel Borkmann
Committed by David S. Miller
1 parent f9e42b8535

net: sctp: sctp_sf_do_prm_asoc: do SCTP_CMD_INIT_CHOOSE_TRANSPORT first

While this currently cannot trigger any NULL pointer dereference in
sctp_seq_dump_local_addrs(), better change the order of commands to
prevent a future bug to happen. Although we first add SCTP_CMD_NEW_ASOC
and then set the SCTP_CMD_INIT_CHOOSE_TRANSPORT, it is okay for now,
since this primitive is only called by sctp_connect() or sctp_sendmsg()
with sctp_assoc_add_peer() set first. However, lets do this precaution
and first set the transport and then add it to the association hashlist
to prevent in future something to possibly triggering this.

Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 1 changed file with 4 additions and 4 deletions Side-by-side Diff

net/sctp/sm_statefuns.c
... ... @@ -4632,15 +4632,15 @@
4632 4632 if (!repl)
4633 4633 goto nomem;
4634 4634  
  4635 + /* Choose transport for INIT. */
  4636 + sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
  4637 + SCTP_CHUNK(repl));
  4638 +
4635 4639 /* Cast away the const modifier, as we want to just
4636 4640 * rerun it through as a sideffect.
4637 4641 */
4638 4642 my_asoc = (struct sctp_association *)asoc;
4639 4643 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(my_asoc));
4640   -
4641   - /* Choose transport for INIT. */
4642   - sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
4643   - SCTP_CHUNK(repl));
4644 4644  
4645 4645 /* After sending the INIT, "A" starts the T1-init timer and
4646 4646 * enters the COOKIE-WAIT state.