Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/pci-2.6

[linux.git] / net / sctp / inqueue.c

diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index 88aa2240754935522962a001088286516a8f8011..cf4b7eb023b3ba0819ce6d960128099c662360af 100644 (file)
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -90,6 +90,10 @@ void sctp_inq_free(struct sctp_inq *queue)
 void sctp_inq_push(struct sctp_inq *q, struct sctp_chunk *chunk)
 {
        /* Directly call the packet handling routine. */
+       if (chunk->rcvr->dead) {
+               sctp_chunk_free(chunk);
+               return;
+       }
 
        /* We are now calling this either from the soft interrupt
         * or from the backlog processing.
@@ -100,6 +104,25 @@ void sctp_inq_push(struct sctp_inq *q, struct sctp_chunk *chunk)
        q->immediate.func(&q->immediate);
 }
 
+/* Peek at the next chunk on the inqeue. */
+struct sctp_chunkhdr *sctp_inq_peek(struct sctp_inq *queue)
+{
+       struct sctp_chunk *chunk;
+       sctp_chunkhdr_t *ch = NULL;
+
+       chunk = queue->in_progress;
+       /* If there is no more chunks in this packet, say so */
+       if (chunk->singleton ||
+           chunk->end_of_packet ||
+           chunk->pdiscard)
+                   return NULL;
+
+       ch = (sctp_chunkhdr_t *)chunk->chunk_end;
+
+       return ch;
+}
+
+
 /* Extract a chunk from an SCTP inqueue.
  *
  * WARNING:  If you need to put the chunk on another queue, you need to
@@ -130,6 +153,14 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue)
                        /* Force chunk->skb->data to chunk->chunk_end.  */
                        skb_pull(chunk->skb,
                                 chunk->chunk_end - chunk->skb->data);
+
+                       /* Verify that we have at least chunk headers
+                        * worth of buffer left.
+                        */
+                       if (skb_headlen(chunk->skb) < sizeof(sctp_chunkhdr_t)) {
+                               sctp_chunk_free(chunk);
+                               chunk = queue->in_progress = NULL;
+                       }
                }
        }