diff options
| author | Xin Long <[email protected]> | 2017-12-18 06:07:25 +0000 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2017-12-18 18:21:46 +0000 |
| commit | 5c468674d17056148da06218d4da5d04baf22eac (patch) | |
| tree | 65dc8499eee2f0c96094daa1493e9259a0f57a3e /lib/timerqueue.c | |
| parent | net: qcom/emac: Change the order of mac up and sgmii open (diff) | |
| download | kernel-5c468674d17056148da06218d4da5d04baf22eac.tar.gz kernel-5c468674d17056148da06218d4da5d04baf22eac.zip | |
sctp: fix the issue that a __u16 variable may overflow in sctp_ulpq_renege
Now when reneging events in sctp_ulpq_renege(), the variable freed
could be increased by a __u16 value twice while freed is of __u16
type. It means freed may overflow at the second addition.
This patch is to fix it by using __u32 type for 'freed', while at
it, also to remove 'if (chunk)' check, as all renege commands are
generated in sctp_eat_data and it can't be NULL.
Reported-by: Marcelo Ricardo Leitner <[email protected]>
Signed-off-by: Xin Long <[email protected]>
Acked-by: Neil Horman <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Diffstat (limited to 'lib/timerqueue.c')
0 files changed, 0 insertions, 0 deletions