Merge git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-nmw

[linux-2.6-omap-h63xx.git] / net / sctp / inqueue.c

diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index c30629e177814cc1313f7a710999ffdfe67b873c..f10fe7fbf24c425ca9609e46ed837d505a39552b 100644 (file)
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -100,6 +100,25 @@ void sctp_inq_push(struct sctp_inq *q, struct sctp_chunk *chunk)
        q->immediate.func(&q->immediate);
 }
 
+/* Peek at the next chunk on the inqeue. */
+struct sctp_chunkhdr *sctp_inq_peek(struct sctp_inq *queue)
+{
+       struct sctp_chunk *chunk;
+       sctp_chunkhdr_t *ch = NULL;
+
+       chunk = queue->in_progress;
+       /* If there is no more chunks in this packet, say so */
+       if (chunk->singleton ||
+           chunk->end_of_packet ||
+           chunk->pdiscard)
+                   return NULL;
+
+       ch = (sctp_chunkhdr_t *)chunk->chunk_end;
+
+       return ch;
+}
+
+
 /* Extract a chunk from an SCTP inqueue.
  *
  * WARNING:  If you need to put the chunk on another queue, you need to
@@ -130,6 +149,14 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue)
                        /* Force chunk->skb->data to chunk->chunk_end.  */
                        skb_pull(chunk->skb,
                                 chunk->chunk_end - chunk->skb->data);
+
+                       /* Verify that we have at least chunk headers
+                        * worth of buffer left.
+                        */
+                       if (skb_headlen(chunk->skb) < sizeof(sctp_chunkhdr_t)) {
+                               sctp_chunk_free(chunk);
+                               chunk = queue->in_progress = NULL;
+                       }
                }
        }
 
@@ -159,16 +186,16 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue)
         * the skb->tail.
         */
        if (unlikely(skb_is_nonlinear(chunk->skb))) {
-               if (chunk->chunk_end > chunk->skb->tail)
-                       chunk->chunk_end = chunk->skb->tail;
+               if (chunk->chunk_end > skb_tail_pointer(chunk->skb))
+                       chunk->chunk_end = skb_tail_pointer(chunk->skb);
        }
        skb_pull(chunk->skb, sizeof(sctp_chunkhdr_t));
        chunk->subh.v = NULL; /* Subheader is no longer valid.  */
 
-       if (chunk->chunk_end < chunk->skb->tail) {
+       if (chunk->chunk_end < skb_tail_pointer(chunk->skb)) {
                /* This is not a singleton */
                chunk->singleton = 0;
-       } else if (chunk->chunk_end > chunk->skb->tail) {
+       } else if (chunk->chunk_end > skb_tail_pointer(chunk->skb)) {
                /* RFC 2960, Section 6.10  Bundling
                 *
                 * Partial chunks MUST NOT be placed in an SCTP packet.