commit 04e5d64c454ec53103fa1f4b7f3634bb61a65d0f
author Marco Varlese <marco.varlese@suse.com> Fri Feb 23 17:43:06 2018 +0100
committer Florin Coras <florin.coras@gmail.com> Sun Feb 25 19:33:48 2018 +0000
tree eb934071bb2254bea39bca2a9804caa07393b4d9
parent 3473e4938718a820b63edaeab5ae7738c31379d5

SCTP: fix connection memory corruption

A bug was found when multiple SCTP connections were being opened to the
same SCTP server. This patch addresses that problem, removing the use of
the 'parent' pointer approach for sub-connection and saving instead
within the sub-connection itself the ID representing its position. That
facilitates pointer-arithmetic to be computed in the
get_connection_from_transport().

Change-Id: Iaa1f4efc501590be1c93e42fd6fe3d6e02f635eb
Signed-off-by: Marco Varlese <marco.varlese@suse.com>

src/vnet/sctp/sctp_output.c

diff --git a/src/vnet/sctp/sctp_output.c b/src/vnet/sctp/sctp_output.c
index 39e5e75..a9b2417 100644
--- a/src/vnet/sctp/sctp_output.c
+++ b/src/vnet/sctp/sctp_output.c
@@ -1094,7 +1094,7 @@
 
   u8 idx = sctp_data_subconn_select (sctp_conn);
   SCTP_DBG_OUTPUT
-    ("SCTP_CONN = %p, IDX = %u, S_INDEX = %u, C_INDEX = %u, LCL_PORT = %u, RMT_PORT = %u",
+    ("SCTP_CONN = %p, IDX = %u, S_INDEX = %u, C_INDEX = %u, sctp_conn->[...].LCL_PORT = %u, sctp_conn->[...].RMT_PORT = %u",
      sctp_conn, idx, sctp_conn->sub_conn[idx].connection.s_index,
      sctp_conn->sub_conn[idx].connection.c_index,
      sctp_conn->sub_conn[idx].connection.lcl_port,
@@ -1149,7 +1149,7 @@
 
   SCTP_DBG_OUTPUT ("TRANS_CONN = %p, SCTP_CONN = %p, "
 		   "S_INDEX = %u, C_INDEX = %u,"
-		   "LCL_PORT = %u, RMT_PORT = %u",
+		   "trans_conn->LCL_PORT = %u, trans_conn->RMT_PORT = %u",
 		   trans_conn,
 		   sctp_conn,
 		   trans_conn->s_index,