diff options
| author | Neil Horman <nhorman@tuxdriver.com> | 2006-05-05 17:02:09 -0700 |
|---|---|---|
| committer | Chris Wright <chrisw@sous-sol.org> | 2006-05-09 12:53:21 -0700 |
| commit | 2e2a2cd09dd7b3fbc99a1879a54090fd6db16f0c (patch) | |
| tree | 0ec7e0b342f783c4a6ebe9ed083ddec41182041f /include | |
| parent | cb19baa0bb7a4064e6d0c99e8f479673120a9f28 (diff) | |
| download | linux-stable-2e2a2cd09dd7b3fbc99a1879a54090fd6db16f0c.tar.gz linux-stable-2e2a2cd09dd7b3fbc99a1879a54090fd6db16f0c.tar.bz2 linux-stable-2e2a2cd09dd7b3fbc99a1879a54090fd6db16f0c.zip | |
[PATCH] SCTP: Allow spillover of receive buffer to avoid deadlock. (CVE-2006-2275)
This patch fixes a deadlock situation in the receive path by allowing
temporary spillover of the receive buffer.
- If the chunk we receive has a tsn that immediately follows the ctsn,
accept it even if we run out of receive buffer space and renege data with
higher TSNs.
- Once we accept one chunk in a packet, accept all the remaining chunks
even if we run out of receive buffer space.
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Mark Butler <butlerm@middle.net>
Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/net/sctp/structs.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h index 072f407848a6..acb2ce16e6d5 100644 --- a/include/net/sctp/structs.h +++ b/include/net/sctp/structs.h @@ -702,6 +702,7 @@ struct sctp_chunk { __u8 tsn_gap_acked; /* Is this chunk acked by a GAP ACK? */ __s8 fast_retransmit; /* Is this chunk fast retransmitted? */ __u8 tsn_missing_report; /* Data chunk missing counter. */ + __u8 data_accepted; /* At least 1 chunk in this packet accepted */ }; void sctp_chunk_hold(struct sctp_chunk *); |