sctp: discard stale INIT after handshake completion

After an association reaches ESTABLISHED, the peer’s init_tag is already
known from the handshake. Any subsequent INIT with the same init_tag is
not a valid restart, but a delayed or duplicate INIT.

Drop such INIT chunks in sctp_sf_do_unexpected_init() instead of
processing them as new association attempts.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Link: https://patch.msgid.link/5788c76c1ee122a3ed00189e88dcf9df1fba226c.1777214801.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 7b823d759141917ba6e55b398ae45c46b9bc10b1..8e89a870780c491ac28eaaef46f722beaa7801d6 100644 (file)
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -1556,6 +1556,12 @@ static enum sctp_disposition sctp_sf_do_unexpected_init(
        /* Tag the variable length parameters.  */
        chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr));
 
+       if (asoc->state >= SCTP_STATE_ESTABLISHED) {
+               /* Discard INIT matching peer vtag after handshake completion (stale INIT). */
+               if (ntohl(chunk->subh.init_hdr->init_tag) == asoc->peer.i.init_tag)
+                       return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+       }
+
        /* Verify the INIT chunk before processing it. */
        err_chunk = NULL;
        if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,