Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux...

[karo-tx-linux.git] / net / sctp / sm_statefuns.c

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index a6a0ea71ae93147813abdec8bdd2d3f040950ce3..1c4e5d6c29c07e9c1905235d4adcd1774bee3117 100644 (file)
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -1123,19 +1123,17 @@ sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
                if (from_addr.sa.sa_family == AF_INET6) {
                        if (net_ratelimit())
                                printk(KERN_WARNING
-                                   "%s association %p could not find address "
-                                   NIP6_FMT "\n",
+                                   "%s association %p could not find address %pI6\n",
                                    __func__,
                                    asoc,
-                                   NIP6(from_addr.v6.sin6_addr));
+                                   &from_addr.v6.sin6_addr);
                } else {
                        if (net_ratelimit())
                                printk(KERN_WARNING
-                                   "%s association %p could not find address "
-                                   NIPQUAD_FMT "\n",
+                                   "%s association %p could not find address %pI4\n",
                                    __func__,
                                    asoc,
-                                   NIPQUAD(from_addr.v4.sin_addr.s_addr));
+                                   &from_addr.v4.sin_addr.s_addr);
                }
                return SCTP_DISPOSITION_DISCARD;
        }
@@ -3691,6 +3689,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn(const struct sctp_endpoint *ep,
 {
        struct sctp_chunk *chunk = arg;
        struct sctp_fwdtsn_hdr *fwdtsn_hdr;
+       struct sctp_fwdtsn_skip *skip;
        __u16 len;
        __u32 tsn;
 
@@ -3720,6 +3719,12 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn(const struct sctp_endpoint *ep,
        if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
                goto discard_noforce;
 
+       /* Silently discard the chunk if stream-id is not valid */
+       sctp_walk_fwdtsn(skip, chunk) {
+               if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
+                       goto discard_noforce;
+       }
+
        sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
        if (len > sizeof(struct sctp_fwdtsn_hdr))
                sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
@@ -3751,6 +3756,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
 {
        struct sctp_chunk *chunk = arg;
        struct sctp_fwdtsn_hdr *fwdtsn_hdr;
+       struct sctp_fwdtsn_skip *skip;
        __u16 len;
        __u32 tsn;
 
@@ -3780,6 +3786,12 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
        if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
                goto gen_shutdown;
 
+       /* Silently discard the chunk if stream-id is not valid */
+       sctp_walk_fwdtsn(skip, chunk) {
+               if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
+                       goto gen_shutdown;
+       }
+
        sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
        if (len > sizeof(struct sctp_fwdtsn_hdr))
                sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,