1 files changed, 14 insertions, 0 deletions

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 9f2a3eb656e5..1c4e5d6c29c0 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3689,6 +3689,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn(const struct sctp_endpoint *ep,
 {
         struct sctp_chunk *chunk = arg;
         struct sctp_fwdtsn_hdr *fwdtsn_hdr;
+        struct sctp_fwdtsn_skip *skip;
         __u16 len;
         __u32 tsn;
 
@@ -3718,6 +3719,12 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn(const struct sctp_endpoint *ep,
         if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
                 goto discard_noforce;
 
+        /* Silently discard the chunk if stream-id is not valid */
+        sctp_walk_fwdtsn(skip, chunk) {
+                if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
+                        goto discard_noforce;
+        }
+
         sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
         if (len > sizeof(struct sctp_fwdtsn_hdr))
                 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,
@@ -3749,6 +3756,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
 {
         struct sctp_chunk *chunk = arg;
         struct sctp_fwdtsn_hdr *fwdtsn_hdr;
+        struct sctp_fwdtsn_skip *skip;
         __u16 len;
         __u32 tsn;
 
@@ -3778,6 +3786,12 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
         if (sctp_tsnmap_check(&asoc->peer.tsn_map, tsn) < 0)
                 goto gen_shutdown;
 
+        /* Silently discard the chunk if stream-id is not valid */
+        sctp_walk_fwdtsn(skip, chunk) {
+                if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
+                        goto gen_shutdown;
+        }
+
         sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_FWDTSN, SCTP_U32(tsn));
         if (len > sizeof(struct sctp_fwdtsn_hdr))
                 sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_FWDTSN,