1 files changed, 72 insertions, 6 deletions

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index d4c3fbc4671e..1c4e5d6c29c0 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -1123,19 +1123,17 @@ sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
                 if (from_addr.sa.sa_family == AF_INET6) {
                         if (net_ratelimit())
                                 printk(KERN_WARNING
-                                    "%s association %p could not find address "
-                                    NIP6_FMT "\n",
+                                    "%s association %p could not find address %pI6\n",
                                     __func__,
                                     asoc,
-                                    NIP6(from_addr.v6.sin6_addr));
+                                    &from_addr.v6.sin6_addr);
                 } else {
                         if (net_ratelimit())
                                 printk(KERN_WARNING
-                                    "%s association %p could not find address "
-                                    NIPQUAD_FMT "\n",
+                                    "%s association %p could not find address %pI4\n",
                                     __func__,
                                     asoc,
-                                    NIPQUAD(from_addr.v4.sin_addr.s_addr));
+                                    &from_addr.v4.sin_addr.s_addr);
                 }
                 return SCTP_DISPOSITION_DISCARD;
         }
@@ -2544,6 +2542,7 @@ sctp_disposition_t sctp_sf_do_9_2_shutdown(const struct sctp_endpoint *ep,
         sctp_shutdownhdr_t *sdh;
         sctp_disposition_t disposition;
         struct sctp_ulpevent *ev;
+        __u32 ctsn;
 
         if (!sctp_vtag_verify(chunk, asoc))
                 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
@@ -2558,6 +2557,14 @@ sctp_disposition_t sctp_sf_do_9_2_shutdown(const struct sctp_endpoint *ep,
         sdh = (sctp_shutdownhdr_t *)chunk->skb->data;
         skb_pull(chunk->skb, sizeof(sctp_shutdownhdr_t));
         chunk->subh.shutdown_hdr = sdh;
+        ctsn = ntohl(sdh->cum_tsn_ack);
+
+        /* If Cumulative TSN Ack beyond the max tsn currently
+         * send, terminating the association and respond to the
+         * sender with an ABORT.
+         */
+        if (!TSN_lt(ctsn, asoc->next_tsn))
+                return sctp_sf_violation_ctsn(ep, asoc, type, arg, commands);
 
         /* API 5.3.1.5 SCTP_SHUTDOWN_EVENT
          * When a peer sends a SHUTDOWN, SCTP delivers this notification to
@@ -2599,6 +2606,51 @@ out:
         return disposition;
 }
 
+/*
+ * sctp_sf_do_9_2_shut_ctsn
+ *
+ * Once an endpoint has reached the SHUTDOWN-RECEIVED state,
+ * it MUST NOT send a SHUTDOWN in response to a ULP request.
+ * The Cumulative TSN Ack of the received SHUTDOWN chunk
+ * MUST be processed.
+ */
+sctp_disposition_t sctp_sf_do_9_2_shut_ctsn(const struct sctp_endpoint *ep,
+                                           const struct sctp_association *asoc,
+                                           const sctp_subtype_t type,
+                                           void *arg,
+                                           sctp_cmd_seq_t *commands)
+{
+        struct sctp_chunk *chunk = arg;
+        sctp_shutdownhdr_t *sdh;
+
+        if (!sctp_vtag_verify(chunk, asoc))
+                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+
+        /* Make sure that the SHUTDOWN chunk has a valid length. */
+        if (!sctp_chunk_length_valid(chunk,
+                                      sizeof(struct sctp_shutdown_chunk_t)))
+                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                                                  commands);
+
+        sdh = (sctp_shutdownhdr_t *)chunk->skb->data;
+
+        /* If Cumulative TSN Ack beyond the max tsn currently
+         * send, terminating the association and respond to the
+         * sender with an ABORT.
+         */
+        if (!TSN_lt(ntohl(sdh->cum_tsn_ack), asoc->next_tsn))
+                return sctp_sf_violation_ctsn(ep, asoc, type, arg, commands);
+
+        /* verify, by checking the Cumulative TSN Ack field of the
+         * chunk, that all its outstanding DATA chunks have been
+         * received by the SHUTDOWN sender.
+         */
+        sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_CTSN,
+                        SCTP_BE32(sdh->cum_tsn_ack));
+
+        return SCTP_DISPOSITION_CONSUME;
+}
+
 /* RFC 2960 9.2
  * If an endpoint is in SHUTDOWN-ACK-SENT state and receives an INIT chunk
  * (e.g., if the SHUTDOWN COMPLETE was lost) with source and destination
@@ -3637,6 +3689,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn(const struct sctp_endpoint *ep,
 {
         struct sctp_chunk *chunk = arg;
         struct sctp_fwdtsn_hdr *fwdtsn_hdr;
+        struct sctp_fwdtsn_skip *skip;
         __u16 len;
         __u32 tsn;
 
@@ -3666,6 +3719,12 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn(const struct sctp_endpoint *ep,
         if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
                 goto discard_noforce;
 
+        /* Silently discard the chunk if stream-id is not valid */
+        sctp_walk_fwdtsn(skip, chunk) {
+                if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
+                        goto discard_noforce;
+        }
+
         sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
         if (len > sizeof(struct sctp_fwdtsn_hdr))
                 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
@@ -3697,6 +3756,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
 {
         struct sctp_chunk *chunk = arg;
         struct sctp_fwdtsn_hdr *fwdtsn_hdr;
+        struct sctp_fwdtsn_skip *skip;
         __u16 len;
         __u32 tsn;
 
@@ -3726,6 +3786,12 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
         if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
                 goto gen_shutdown;
 
+        /* Silently discard the chunk if stream-id is not valid */
+        sctp_walk_fwdtsn(skip, chunk) {
+                if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
+                        goto gen_shutdown;
+        }
+
         sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
         if (len > sizeof(struct sctp_fwdtsn_hdr))
                 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,