rxrpc: Fix several cases where a padded len isn't checked in ticket decode

[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / sctp / sm_sideeffect.c

diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 8aab894aeabeecb410c9763e33824f5dec7a6c91..730914cdb7a141599c7eebe5fd43c0f67a0549d0 100644 (file)
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -251,12 +251,13 @@ void sctp_generate_t3_rtx_event(unsigned long peer)
        int error;
        struct sctp_transport *transport = (struct sctp_transport *) peer;
        struct sctp_association *asoc = transport->asoc;
-       struct net *net = sock_net(asoc->base.sk);
+       struct sock *sk = asoc->base.sk;
+       struct net *net = sock_net(sk);
 
        /* Check whether a task is in the sock.  */
 
-       sctp_bh_lock_sock(asoc->base.sk);
-       if (sock_owned_by_user(asoc->base.sk)) {
+       sctp_bh_lock_sock(sk);
+       if (sock_owned_by_user(sk)) {
                SCTP_DEBUG_PRINTK("%s:Sock is busy.\n", __func__);
 
                /* Try again later.  */
@@ -279,10 +280,10 @@ void sctp_generate_t3_rtx_event(unsigned long peer)
                           transport, GFP_ATOMIC);
 
        if (error)
-               asoc->base.sk->sk_err = -error;
+               sk->sk_err = -error;
 
 out_unlock:
-       sctp_bh_unlock_sock(asoc->base.sk);
+       sctp_bh_unlock_sock(sk);
        sctp_transport_put(transport);
 }
 
@@ -292,11 +293,12 @@ out_unlock:
 static void sctp_generate_timeout_event(struct sctp_association *asoc,
                                        sctp_event_timeout_t timeout_type)
 {
-       struct net *net = sock_net(asoc->base.sk);
+       struct sock *sk = asoc->base.sk;
+       struct net *net = sock_net(sk);
        int error = 0;
 
-       sctp_bh_lock_sock(asoc->base.sk);
-       if (sock_owned_by_user(asoc->base.sk)) {
+       sctp_bh_lock_sock(sk);
+       if (sock_owned_by_user(sk)) {
                SCTP_DEBUG_PRINTK("%s:Sock is busy: timer %d\n",
                                  __func__,
                                  timeout_type);
@@ -320,10 +322,10 @@ static void sctp_generate_timeout_event(struct sctp_association *asoc,
                           (void *)timeout_type, GFP_ATOMIC);
 
        if (error)
-               asoc->base.sk->sk_err = -error;
+               sk->sk_err = -error;
 
 out_unlock:
-       sctp_bh_unlock_sock(asoc->base.sk);
+       sctp_bh_unlock_sock(sk);
        sctp_association_put(asoc);
 }
 
@@ -373,10 +375,11 @@ void sctp_generate_heartbeat_event(unsigned long data)
        int error = 0;
        struct sctp_transport *transport = (struct sctp_transport *) data;
        struct sctp_association *asoc = transport->asoc;
-       struct net *net = sock_net(asoc->base.sk);
+       struct sock *sk = asoc->base.sk;
+       struct net *net = sock_net(sk);
 
-       sctp_bh_lock_sock(asoc->base.sk);
-       if (sock_owned_by_user(asoc->base.sk)) {
+       sctp_bh_lock_sock(sk);
+       if (sock_owned_by_user(sk)) {
                SCTP_DEBUG_PRINTK("%s:Sock is busy.\n", __func__);
 
                /* Try again later.  */
@@ -397,10 +400,10 @@ void sctp_generate_heartbeat_event(unsigned long data)
                           transport, GFP_ATOMIC);
 
         if (error)
-                asoc->base.sk->sk_err = -error;
+                sk->sk_err = -error;
 
 out_unlock:
-       sctp_bh_unlock_sock(asoc->base.sk);
+       sctp_bh_unlock_sock(sk);
        sctp_transport_put(transport);
 }
 
@@ -411,10 +414,11 @@ void sctp_generate_proto_unreach_event(unsigned long data)
 {
        struct sctp_transport *transport = (struct sctp_transport *) data;
        struct sctp_association *asoc = transport->asoc;
-       struct net *net = sock_net(asoc->base.sk);
+       struct sock *sk = asoc->base.sk;
+       struct net *net = sock_net(sk);
        
-       sctp_bh_lock_sock(asoc->base.sk);
-       if (sock_owned_by_user(asoc->base.sk)) {
+       sctp_bh_lock_sock(sk);
+       if (sock_owned_by_user(sk)) {
                SCTP_DEBUG_PRINTK("%s:Sock is busy.\n", __func__);
 
                /* Try again later.  */
@@ -435,7 +439,7 @@ void sctp_generate_proto_unreach_event(unsigned long data)
                   asoc->state, asoc->ep, asoc, transport, GFP_ATOMIC);
 
 out_unlock:
-       sctp_bh_unlock_sock(asoc->base.sk);
+       sctp_bh_unlock_sock(sk);
        sctp_association_put(asoc);
 }