diff --git a/[refs] b/[refs] index edb399989e80..f4b993b79955 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: ece25dfa0991f65c4e1d26beb1c3c45bda4239b8 +refs/heads/master: 3c77f961b55b6060858c68a213d7f4470d7f3eb2 diff --git a/trunk/net/sctp/input.c b/trunk/net/sctp/input.c index 47e56017f4ce..f9a0c9276e3b 100644 --- a/trunk/net/sctp/input.c +++ b/trunk/net/sctp/input.c @@ -622,6 +622,14 @@ static int sctp_rcv_ootb(struct sk_buff *skb) if (SCTP_CID_SHUTDOWN_COMPLETE == ch->type) goto discard; + /* RFC 4460, 2.11.2 + * This will discard packets with INIT chunk bundled as + * subsequent chunks in the packet. When INIT is first, + * the normal INIT processing will discard the chunk. + */ + if (SCTP_CID_INIT == ch->type && (void *)ch != skb->data) + goto discard; + /* RFC 8.4, 7) If the packet contains a "Stale cookie" ERROR * or a COOKIE ACK the SCTP Packet should be silently * discarded.