| リビジョン | 863c2673cea6702422e722aa754fe3845413e20c (tree) |
|---|---|
| 日時 | 2006-08-31 05:45:34 |
| 作者 | dann frazier <dannf@dann...> |
| コミッター | Willy Tarreau |
[PATCH] [SCTP] Fix sctp_primitive_ABORT() call in sctp_close()
Here is a 2.4 backport of David's fix for a problem with the recent
embargoed patch for CVE-2006-3745. Compile-tested, original
description follows:
[SCTP]: Fix sctp_primitive_ABORT() call in sctp_close().
With the recent fix, the callers of sctp_primitive_ABORT()
need to create an ABORT chunk and pass it as an argument rather
than msghdr that was passed earlier.
Signed-off-by: dann frazier <dannf@debian.org>
net/sctp/socket.c (diff)| @@ -967,9 +967,13 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout) | ||
| 967 | 967 | sctp_unhash_established(asoc); |
| 968 | 968 | sctp_association_free(asoc); |
| 969 | 969 | |
| 970 | - } else if (sk->linger && !sk->lingertime) | |
| 971 | - sctp_primitive_ABORT(asoc, NULL); | |
| 972 | - else | |
| 970 | + } else if (sk->linger && !sk->lingertime) { | |
| 971 | + struct sctp_chunk *chunk; | |
| 972 | + | |
| 973 | + chunk = sctp_make_abort_user(asoc, NULL, 0); | |
| 974 | + if (chunk) | |
| 975 | + sctp_primitive_ABORT(asoc, NULL); | |
| 976 | + } else | |
| 973 | 977 | sctp_primitive_SHUTDOWN(asoc, NULL); |
| 974 | 978 | } else |
| 975 | 979 | sctp_primitive_SHUTDOWN(asoc, NULL); |
Linux Kernel Documents
Fork