sctp: Fix malformed "Invalid Stream Identifier" error

The "Invalid Stream Identifier" error has a 16 bit reserved
field at the end, thus making the parameter length be 8 bytes.
We've never supplied that reserved field making wireshark
tag the packet as malformed.

Reported-by: Chris Dischino <cdischino@sonusnet.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>

1 files changed, 8 insertions, 5 deletions

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 8ee24c9dc7e9..16a603527df2 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -1720,7 +1720,7 @@ static sctp_disposition_t sctp_sf_do_dupcook_a(const struct sctp_endpoint *ep,
 
                 err = sctp_make_op_error(asoc, chunk,
                                          SCTP_ERROR_COOKIE_IN_SHUTDOWN,
-                                         NULL, 0);
+                                         NULL, 0, 0);
                 if (err)
                         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
                                         SCTP_CHUNK(err));
@@ -3977,7 +3977,7 @@ sctp_disposition_t sctp_sf_eat_auth(const struct sctp_endpoint *ep,
                         err_chunk = sctp_make_op_error(asoc, chunk,
                                                         SCTP_ERROR_UNSUP_HMAC,
                                                         &auth_hdr->hmac_id,
-                                                        sizeof(__u16));
+                                                        sizeof(__u16), 0);
                         if (err_chunk) {
                                 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
                                                 SCTP_CHUNK(err_chunk));
@@ -4069,7 +4069,8 @@ sctp_disposition_t sctp_sf_unk_chunk(const struct sctp_endpoint *ep,
                 hdr = unk_chunk->chunk_hdr;
                 err_chunk = sctp_make_op_error(asoc, unk_chunk,
                                                SCTP_ERROR_UNKNOWN_CHUNK, hdr,
-                                               WORD_ROUND(ntohs(hdr->length)));
+                                               WORD_ROUND(ntohs(hdr->length)),
+                                               0);
                 if (err_chunk) {
                         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
                                         SCTP_CHUNK(err_chunk));
@@ -4088,7 +4089,8 @@ sctp_disposition_t sctp_sf_unk_chunk(const struct sctp_endpoint *ep,
                 hdr = unk_chunk->chunk_hdr;
                 err_chunk = sctp_make_op_error(asoc, unk_chunk,
                                                SCTP_ERROR_UNKNOWN_CHUNK, hdr,
-                                               WORD_ROUND(ntohs(hdr->length)));
+                                               WORD_ROUND(ntohs(hdr->length)),
+                                               0);
                 if (err_chunk) {
                         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
                                         SCTP_CHUNK(err_chunk));
@@ -6052,7 +6054,8 @@ static int sctp_eat_data(const struct sctp_association *asoc,
 
                 err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM,
                                          &data_hdr->stream,
-                                         sizeof(data_hdr->stream));
+                                         sizeof(data_hdr->stream),
+                                         sizeof(u16));
                 if (err)
                         sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
                                         SCTP_CHUNK(err));