tree 30a5946dec870081f36bc0c779a3b5b243349424
parent d1dd524785e30cf3d64d395d829b207376acb0aa
author Wei Yongjun <yjwei@cn.fujitsu.com> 1235976411 +0000
committer David S. Miller <davem@davemloft.net> 1236061659 -0800

sctp: fix kernel panic with ERROR chunk containing too many error causes

If ERROR chunk is received with too many error causes in ESTABLISHED
state, the kernel get panic.

This is because sctp limit the max length of cmds to 14, but while
ERROR chunk is received, one error cause will add around 2 cmds by
sctp_add_cmd_sf(). So many error causes will fill the limit of cmds
and panic.

This patch fixed the problem.

This bug can be test by SCTP Conformance Test Suite
<http://networktest.sourceforge.net/>.

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>