From d145e503bd0911cd6216d24d7a35e01408ca8052 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@suse.de>
Date: Wed, 30 Jun 2010 10:51:38 -0700
Subject: [PATCH] .27 patch

---
 ...error-cause-to-error-chunk-correctly.patch | 46 +++++++++++++++++++
 queue-2.6.27/series                           |  1 +
 2 files changed, 47 insertions(+)
 create mode 100644 queue-2.6.27/sctp-fix-append-error-cause-to-error-chunk-correctly.patch

diff --git a/queue-2.6.27/sctp-fix-append-error-cause-to-error-chunk-correctly.patch b/queue-2.6.27/sctp-fix-append-error-cause-to-error-chunk-correctly.patch
new file mode 100644
index 00000000000..8b3511ff08d
--- /dev/null
+++ b/queue-2.6.27/sctp-fix-append-error-cause-to-error-chunk-correctly.patch
@@ -0,0 +1,46 @@
+From 2e3219b5c8a2e44e0b83ae6e04f52f20a82ac0f2 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <yjwei@cn.fujitsu.com>
+Date: Mon, 17 May 2010 22:51:58 -0700
+Subject: sctp: fix append error cause to ERROR chunk correctly
+
+From: Wei Yongjun <yjwei@cn.fujitsu.com>
+
+commit 2e3219b5c8a2e44e0b83ae6e04f52f20a82ac0f2 upstream.
+
+commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809
+  sctp: Fix skb_over_panic resulting from multiple invalid \
+    parameter errors (CVE-2010-1173) (v4)
+
+cause 'error cause' never be add the the ERROR chunk due to
+some typo when check valid length in sctp_init_cause_fixed().
+
+Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
+Reviewed-by: Neil Horman <nhorman@tuxdriver.com>
+Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sctp/sm_make_chunk.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -140,7 +140,7 @@ int sctp_init_cause_fixed(struct sctp_ch
+ 	len = sizeof(sctp_errhdr_t) + paylen;
+ 	err.length  = htons(len);
+ 
+-	if (skb_tailroom(chunk->skb) >  len)
++	if (skb_tailroom(chunk->skb) < len)
+ 		return -ENOSPC;
+ 	chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk,
+ 						     sizeof(sctp_errhdr_t),
+@@ -1401,7 +1401,7 @@ void *sctp_addto_chunk(struct sctp_chunk
+ void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk,
+ 			     int len, const void *data)
+ {
+-	if (skb_tailroom(chunk->skb) > len)
++	if (skb_tailroom(chunk->skb) >= len)
+ 		return sctp_addto_chunk(chunk, len, data);
+ 	else
+ 		return NULL;
diff --git a/queue-2.6.27/series b/queue-2.6.27/series
index 0bbf3de9a8c..2511321066d 100644
--- a/queue-2.6.27/series
+++ b/queue-2.6.27/series
@@ -20,3 +20,4 @@ tipc-fix-oops-on-send-prior-to-entering-networked-mode-v3.patch
 parisc-clear-floating-point-exception-flag-on-sigfpe-signal.patch
 keys-return-more-accurate-error-codes.patch
 keys-find_keyring_by_name-can-gain-access-to-a-freed-keyring.patch
+sctp-fix-append-error-cause-to-error-chunk-correctly.patch
-- 
2.47.3