sctp: fix append error cause to ERROR chunk correctly

Fix regression due to fix for CVE-2010-1173

svn path=/dists/sid/linux-2.6/; revision=15841

debian/changelog

@@ -13,6 +13,8 @@ linux-2.6 (2.6.32-16) UNRELEASED; urgency=low
   * Update Spanish debconf templates, thanks to Omar Campagne
     (Closes: #580538)
   * Revert "Add EC path for Thinkpad X100."; it is incomplete and broken
+  * sctp: fix append error cause to ERROR chunk correctly (regression due
+    to fix for CVE-2010-1173)
 
   [ Aurelien Jarno ]
   * [sh4] fix sh_tmu clocksource following recent nohz changes.

debian/patches/bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch

@@ -0,0 +1,46 @@
+From: Wei Yongjun <yjwei@cn.fujitsu.com>
+Date: Mon, 17 May 2010 22:51:58 -0700
+Subject: [PATCH] sctp: fix append error cause to ERROR chunk correctly
+
+commit 2e3219b5c8a2e44e0b83ae6e04f52f20a82ac0f2 upstream.
+
+commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809
+  sctp: Fix skb_over_panic resulting from multiple invalid \
+    parameter errors (CVE-2010-1173) (v4)
+
+cause 'error cause' never be add the the ERROR chunk due to
+some typo when check valid length in sctp_init_cause_fixed().
+
+Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
+Reviewed-by: Neil Horman <nhorman@tuxdriver.com>
+Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/sctp/sm_make_chunk.c |    4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index d8261f3..bd2a50b 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -141,7 +141,7 @@ int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code,
+ 	len = sizeof(sctp_errhdr_t) + paylen;
+ 	err.length  = htons(len);
+ 
+-	if (skb_tailroom(chunk->skb) >  len)
++	if (skb_tailroom(chunk->skb) < len)
+ 		return -ENOSPC;
+ 	chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk,
+ 						     sizeof(sctp_errhdr_t),
+@@ -1415,7 +1415,7 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
+ void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk,
+ 			     int len, const void *data)
+ {
+-	if (skb_tailroom(chunk->skb) > len)
++	if (skb_tailroom(chunk->skb) >= len)
+ 		return sctp_addto_chunk(chunk, len, data);
+ 	else
+ 		return NULL;
+-- 
+1.7.1
+

debian/patches/series/16

@@ -125,3 +125,4 @@
 + features/all/mantis/0121-V4L-DVB-mantis-Select-correct-frontends.patch
 + features/all/revert-ipv4-Make-INET_LRO-a-bool-instead-of-tristate.patch
 - bugfix/all/thinkpad-acpi-add-x100e.patch
++ bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch