Re: [PATCH] SCTP: Fix Protocol violation when receiving a error length INIT ACK

[Gui Jianfeng <guijianfeng@cn.fujitsu.com>]

Wei Yongjun wrote:
> NACK.
> 
> If the INIT-ACK chunk is too short to contain the init-tag, get the
> init-tag of peer may get a unexpected value.
> Such as this:
>  CHUNK_INIT_ACK
>   Type                             = 2
>   Flags                            = 0
>   Length                           = 4
> 
> So I think the better way is to set T bit of ABORT chunk and used the
> own's Tag.

  Seems reasonable. Please ignore the previous one, here is a new patch.

Signed-off-by: Gui Jianfeng <guijianfeng@cn.fujitsu.com>
---
 net/sctp/outqueue.c     |    3 +++
 net/sctp/sm_statefuns.c |    5 +++++
 2 files changed, 8 insertions(+), 0 deletions(-)

diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 1bb3c5c..c071446 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -793,6 +793,9 @@ int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
 			break;
 
 		case SCTP_CID_ABORT:
+			if (sctp_test_T_bit(chunk)) {
+				packet->vtag = asoc->c.my_vtag;
+			}
 		case SCTP_CID_SACK:
 		case SCTP_CID_HEARTBEAT:
 		case SCTP_CID_HEARTBEAT_ACK:
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index f2ed647..85e1d63 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -4144,6 +4144,11 @@ static sctp_disposition_t sctp_sf_abort_violation(
 		goto nomem;
 
 	if (asoc) {
+		/* Treat INIT-ACK as a special case. */
+		if (chunk->chunk_hdr->type == SCTP_CID_INIT_ACK) {
+			abort->chunk_hdr->flags |= SCTP_CHUNK_FLAG_T;
+		}
+
 		sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
 		SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
 
-- 
1.5.3


-- 
Regards
Gui Jianfeng