sctp: Avoid memory overflow while FWD-TSN chunk is received with

[Wei Yongjun <yjwei@cn.fujitsu.com>]

If FWD-TSN chunk is received with bad stream ID, the sctp will not do the
validity check, this may cause memory overflow when overwrite the TSN of
the stream ID.

The FORWARD-TSN chunk is like this:

FORWARD-TSN chunk
  Type                       = 192
  Flags                      = 0
  Length                     = 172
  NewTSN                     = 99
  Stream                     = 10000
  StreamSequence             = 0xFFFF

This patch fix this problem by skip the stream ID which not less than MIS.

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
---
 net/sctp/ulpqueue.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index 7b23803..dacdc3b 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -940,7 +940,10 @@ void sctp_ulpq_skip(struct sctp_ulpq *ulpq, __u16 sid, __u16 ssn)
 {
 	struct sctp_stream *in;
 
-	/* Note: The stream ID must be verified before this routine.  */
+	/* Skip the stream ID which larger than MIS */
+	if (sid >= ulpq->asoc->c.sinit_max_instreams)
+		return;
+
 	in  = &ulpq->asoc->ssnmap->in;
 
 	/* Is this an old SSN?  If so ignore. */
-- 
1.6.0.2.530.g67faa