Xufeng Zhang d3217b15a1 sctp: Fix sk_ack_backlog wrap-around problem ... Consider the scenario: For a TCP-style socket, while processing the COOKIE_ECHO chunk in sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check, a new association would be created in sctp_unpack_cookie(), but afterwards, some processing maybe failed, and sctp_association_free() will be called to free the previously allocated association, in sctp_association_free(), sk_ack_backlog value is decremented for this socket, since the initial value for sk_ack_backlog is 0, after the decrement, it will be 65535, a wrap-around problem happens, and if we want to establish new associations afterward in the same socket, ABORT would be triggered since sctp deem the accept queue as full. Fix this issue by only decrementing sk_ack_backlog for associations in the endpoint's list. Fix-suggested-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: Xufeng Zhang <xufeng.zhang@windriver.com> Acked-by: Daniel Borkmann <dborkman@redhat.com> Acked-by: Vlad Yasevich <vyasevich@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2014-06-12 10:27:14 -07:00
..
9p	A bunch of updates and cleanup within the transport layer,	2014-04-11 14:14:57 -07:00
802	neigh: use NEIGH_VAR_INIT in ndo_neigh_setup functions.	2014-01-16 11:31:58 -08:00
8021q	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-05-24 00:32:30 -04:00
appletalk	net: Split sk_no_check into sk_no_check_{rx,tx}	2014-05-23 16:28:53 -04:00
atm	atm: remove commented out check	2014-05-30 17:17:04 -07:00
ax25	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
batman-adv	net: add __pskb_copy_fclone and pskb_copy_for_clone	2014-06-11 15:38:02 -07:00
bluetooth	net: add __pskb_copy_fclone and pskb_copy_for_clone	2014-06-11 15:38:02 -07:00
bridge	bridge: Support 802.1ad vlan filtering	2014-06-11 15:22:53 -07:00
caif	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
can	can: add hash based access to single EFF frame filters	2014-05-19 09:38:24 +02:00
ceph	ceph: remove bogus extern	2014-06-11 15:39:19 -07:00
core	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-06-11 16:02:55 -07:00
dcb	net: Use netlink_ns_capable to verify the permisions of netlink messages	2014-04-24 13:44:54 -04:00
dccp	net: Eliminate no_check from protosw	2014-05-23 16:28:53 -04:00
decnet	net: Split sk_no_check into sk_no_check_{rx,tx}	2014-05-23 16:28:53 -04:00
dns_resolver	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-06-11 16:02:55 -07:00
dsa	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-05-24 00:32:30 -04:00
ethernet	net: eth_type_trans() should use skb_header_pointer()	2014-01-16 15:30:31 -08:00
hsr	hsr: replace del_timer by del_timer_sync	2014-03-27 15:28:06 -04:00
ieee802154	6lowpan_rtnl: fix off by one while fragmentation	2014-06-02 10:39:42 -07:00
ipv4	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-06-11 16:02:55 -07:00
ipv6	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-06-11 16:02:55 -07:00
ipx	net: Split sk_no_check into sk_no_check_{rx,tx}	2014-05-23 16:28:53 -04:00
irda	net: add build-time checks for msg->msg_name size	2014-01-18 23:04:16 -08:00
iucv	af_iucv: correct cleanup if listen backlog is full	2014-05-30 17:35:23 -07:00
key	af_key: Replace comma with semicolon	2014-05-30 17:48:58 -07:00
l2tp	l2tp: call udp{6}_set_csum	2014-06-04 22:46:38 -07:00
lapb
llc	llc: remove noisy WARN from llc_mac_hdr_init	2014-01-28 18:01:32 -08:00
mac80211	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-06-11 16:02:55 -07:00
mac802154	mac802154: don't deliver packets to devices that are down	2014-06-11 12:10:19 -07:00
mpls	gre: Call gso_make_checksum	2014-06-04 22:46:38 -07:00
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2014-06-05 15:35:04 -07:00
netlabel	netlabel: Fix FSF address in file headers	2013-12-06 12:37:56 -05:00
netlink	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-06-03 23:32:12 -07:00
netrom	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
nfc	net: add __pskb_copy_fclone and pskb_copy_for_clone	2014-06-11 15:38:02 -07:00
openvswitch	vxlan: Add support for UDP checksums (v4 sending, v6 zero csums)	2014-06-04 22:46:39 -07:00
packet	net: Use netlink_ns_capable to verify the permisions of netlink messages	2014-04-24 13:44:54 -04:00
phonet	net: Use netlink_ns_capable to verify the permisions of netlink messages	2014-04-24 13:44:54 -04:00
rds	rds/tcp_listen: Replace comma with semicolon	2014-05-30 17:48:58 -07:00
rfkill	Merge git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next	2014-05-22 13:58:36 -04:00
rose	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
rxrpc	af_rxrpc: Fix XDR length check in rxrpc key demarshalling.	2014-05-16 15:24:47 -04:00
sched	net_sched: drr: warn when qdisc is not work conserving	2014-06-11 15:50:59 -07:00
sctp	sctp: Fix sk_ack_backlog wrap-around problem	2014-06-12 10:27:14 -07:00
sunrpc	net: Save software checksum complete	2014-06-11 15:46:13 -07:00
tipc	net: add __pskb_copy_fclone and pskb_copy_for_clone	2014-06-11 15:38:02 -07:00
unix	net: unix: Align send data_len up to PAGE_SIZE	2014-05-16 16:04:03 -04:00
vmw_vsock	vsock: Make transport the proto owner	2014-05-05 13:13:50 -04:00
wimax	wimax: remove dead code	2013-11-21 13:09:42 -05:00
wireless	Merge git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next	2014-05-29 12:55:38 -04:00
x25	net: Fix use after free by removing length arg from sk_data_ready callbacks.	2014-04-11 16:15:36 -04:00
xfrm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-06-03 23:32:12 -07:00
compat.c	net/compat: convert to COMPAT_SYSCALL_DEFINE with changing parameter types	2014-03-06 16:30:45 +01:00
Kconfig	Merge branch 'for-3.15' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup	2014-04-03 13:05:42 -07:00
Makefile	net: move 6lowpan compression code to separate module	2014-01-15 15:36:38 -08:00
nonet.c
socket.c	net: use SYSCALL_DEFINEx for sys_recv	2014-04-16 15:15:05 -04:00
sysctl_net.c