diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2006-11-20 17:03:01 -0800 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2006-12-02 21:26:27 -0800 |
| commit | 0906e20fa03afdb14faf7fd166bfe4ed67c8db55 (patch) | |
| tree | fba766aba261737ad8968552a3049bd50387531b /net/sctp/associola.c | |
| parent | d5c747f6efc03495635f129c8eb1dad0200ab183 (diff) | |
| download | lwn-0906e20fa03afdb14faf7fd166bfe4ed67c8db55.tar.gz lwn-0906e20fa03afdb14faf7fd166bfe4ed67c8db55.zip | |
[SCTP] bug: sctp_assoc_control_transport() breakage
a) struct sockaddr_storage * passed to sctp_ulpevent_make_peer_addr_change()
actually points at union sctp_addr field in a structure. Then that sucker
gets copied to userland, with whatever junk we might have there.
b) it's actually having host-endian sin_port.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sctp/associola.c')
| -rw-r--r-- | net/sctp/associola.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/sctp/associola.c b/net/sctp/associola.c index 7639044b0074..746b0b0f5ace 100644 --- a/net/sctp/associola.c +++ b/net/sctp/associola.c @@ -709,6 +709,7 @@ void sctp_assoc_control_transport(struct sctp_association *asoc, struct sctp_transport *first; struct sctp_transport *second; struct sctp_ulpevent *event; + struct sockaddr_storage addr; struct list_head *pos; int spc_state = 0; @@ -731,8 +732,9 @@ void sctp_assoc_control_transport(struct sctp_association *asoc, /* Generate and send a SCTP_PEER_ADDR_CHANGE notification to the * user. */ - event = sctp_ulpevent_make_peer_addr_change(asoc, - (struct sockaddr_storage *) &transport->ipaddr, + memset(&addr, 0, sizeof(struct sockaddr_storage)); + flip_to_n((union sctp_addr *)&addr, &transport->ipaddr); + event = sctp_ulpevent_make_peer_addr_change(asoc, &addr, 0, spc_state, error, GFP_ATOMIC); if (event) sctp_ulpq_tail_event(&asoc->ulpq, event); |