Skip to contentSkip to conversation

Fix a type cast bug

PATCH In review Gui Jianfeng 2 participants 2 messages May 16, 2008

Subsystems (3)
Networking Network drivers SCTP protocol
lore
Share & tools
lore

Gui Jianfeng

author
#0 lore raw

PATCH 1/1 Fix a type cast bug

Vlad,

event_arg can never be the type of "struct sctp_chunk *" if the event_type is SCTP_EVENT_T_OTHER. This fix prevents from potential kernel crash by some misuse.

Signed-off-by Gui Jianfeng <[email protected]>
---
 net/sctp/sm_sideeffect.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)
net/sctp/sm_sideeffect.c +2 -1
index a4763fd..1b4bae9 100644
@@ -1072,7 +1072,8 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
 	struct sctp_sackhdr sackh;
 	int local_cork = 0;
 
-	if (SCTP_EVENT_T_TIMEOUT != event_type)
+	if (SCTP_EVENT_T_TIMEOUT != event_type &&
+	    SCTP_EVENT_T_OTHER != event_type)
 		chunk = (struct sctp_chunk *) event_arg;
 
 	/* Note:  This whole file is a huge candidate for rework.
Signature · 5 lines
1.5.3

-- 
Regards
Gui Jianfeng
#1 lore raw

Gui

Quoted 16 lines · Gui Jianfeng

Vlad,

event_arg can never be the type of "struct sctp_chunk *" if the event_type is SCTP_EVENT_T_OTHER. This fix prevents from potential kernel crash by some misuse.

Signed-off-by Gui Jianfeng <[email protected]>
---
 net/sctp/sm_sideeffect.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)
net/sctp/sm_sideeffect.c +0 -0
index a4763fd..1b4bae9 100644

net/sctp/sm_sideeffect.c static int sctp_cmd_interpreter(sctp_event_t event_type, · line 1079

Quoted 9 lines
net/sctp/sm_sideeffect.c +2 -1
@@ -1072,7 +1072,8 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
 	struct sctp_sackhdr sackh;
 	int local_cork = 0;
 
-	if (SCTP_EVENT_T_TIMEOUT != event_type)
+	if (SCTP_EVENT_T_TIMEOUT != event_type &&
+	    SCTP_EVENT_T_OTHER != event_type)
 		chunk = (struct sctp_chunk *) event_arg;
 
 	/* Note:  This whole file is a huge candidate for rework.

This doesn't really fix the bug since the event_arg can be something else during primitive events and you would still have a typecast issue.

This code is rather ugly, but if we are going to clean it up, we need to do right and not band-aid to death.

As it is, NACK on this patch, since it doesn't solve the problem.

-vlad