leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sctp: Fix SKB list traversal in sctp_intl_store_ordered().

Browse Source 
Same change as made to sctp_intl_store_reasm().

To be fully correct, an iterator has an undefined value when something
like skb_queue_walk() naturally terminates.

This will actually matter when SKB queues are converted over to
list_head.

Formalize what this code ends up doing with the current
implementation.

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller
2018-11-10 19:32:23 -08:00
parent 348bbc25c4
commit e15e067d06
1 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
net/sctp/stream_interleave.c
View File

@@ -390,7 +390,7 @@ static void sctp_intl_store_ordered(struct sctp_ulpq *ulpq,
struct sctp_ulpevent *event) struct sctp_ulpevent *event)
{ {
struct sctp_ulpevent *cevent; struct sctp_ulpevent *cevent;
struct sk_buff *pos; struct sk_buff *pos, *loc;
pos = skb_peek_tail(&ulpq->lobby); pos = skb_peek_tail(&ulpq->lobby);
if (!pos) { if (!pos) {
@@ -410,18 +410,25 @@ static void sctp_intl_store_ordered(struct sctp_ulpq *ulpq,
return; return;
} }
loc = NULL;
skb_queue_walk(&ulpq->lobby, pos) { skb_queue_walk(&ulpq->lobby, pos) {
cevent = (struct sctp_ulpevent *)pos->cb; cevent = (struct sctp_ulpevent *)pos->cb;
if (cevent->stream > event->stream) if (cevent->stream > event->stream) {
break; loc = pos;
if (cevent->stream == event->stream &&
MID_lt(event->mid, cevent->mid))
break; break;
} }
if (cevent->stream == event->stream &&
MID_lt(event->mid, cevent->mid)) {
loc = pos;
break;
}
}
__skb_queue_before(&ulpq->lobby, pos, sctp_event2skb(event)); if (!loc)
__skb_queue_tail(&ulpq->lobby, sctp_event2skb(event));
else
__skb_queue_before(&ulpq->lobby, loc, sctp_event2skb(event));
} }
static void sctp_intl_retrieve_ordered(struct sctp_ulpq *ulpq, static void sctp_intl_retrieve_ordered(struct sctp_ulpq *ulpq,