struct sctp_chunk *chunk, unsigned int __nocast gfp, 
struct sctp_chunk *chunk, gfp_t gfp, 
struct sctp_association *sctp_unpack_cookie(	const struct sctp_endpoint *ep,	const struct sctp_association *asoc,	struct sctp_chunk *chunk, unsigned int __nocast gfp,	int *error, struct sctp_chunk **errp){	struct sctp_association *retval = NULL;	struct sctp_signed_cookie *cookie;	struct sctp_cookie *bear_cookie;	int headersize, bodysize, fixed_size;	__u8 digest[SCTP_SIGNATURE_SIZE];	struct scatterlist sg;	unsigned int keylen, len;	char *key;	sctp_scope_t scope;	struct sk_buff *skb = chunk->skb;	struct timeval tv;	headersize = sizeof(sctp_chunkhdr_t) + SCTP_SECRET_SIZE;	bodysize = ntohs(chunk->chunk_hdr->length) - headersize;	fixed_size = headersize + sizeof(struct sctp_cookie);	/* Verify that the chunk looks like it even has a cookie.	 * There must be enough room for our cookie and our peer's	 * INIT chunk.	 */	len = ntohs(chunk->chunk_hdr->length);	if (len < fixed_size + sizeof(struct sctp_chunkhdr))		goto malformed;	/* Verify that the cookie has been padded out. */	if (bodysize % SCTP_COOKIE_MULTIPLE)		goto malformed;	/* Process the cookie.  */	cookie = chunk->subh.cookie_hdr;	bear_cookie = &cookie->c;	if (!sctp_sk(ep->base.sk)->hmac)		goto no_hmac;	/* Check the signature.  */	keylen = SCTP_SECRET_SIZE;	sg.page = virt_to_page(bear_cookie);	sg.offset = (unsigned long)(bear_cookie) % PAGE_SIZE;	sg.length = bodysize;	key = (char *)ep->secret_key[ep->current_key];	memset(digest, 0x00, sizeof(digest));	sctp_crypto_hmac(sctp_sk(ep->base.sk)->hmac, key, &keylen, &sg,			 1, digest);	if (memcmp(digest, cookie->signature, SCTP_SIGNATURE_SIZE)) {		/* Try the previous key. */		key = (char *)ep->secret_key[ep->last_key];		memset(digest, 0x00, sizeof(digest));		sctp_crypto_hmac(sctp_sk(ep->base.sk)->hmac, key, &keylen,				 &sg, 1, digest);		if (memcmp(digest, cookie->signature, SCTP_SIGNATURE_SIZE)) {			/* Yikes!  Still bad signature! */			*error = -SCTP_IERROR_BAD_SIG;			goto fail;		}	}no_hmac:	/* IG Section 2.35.2:	 *  3) Compare the port numbers and the verification tag contained	 *     within the COOKIE ECHO chunk to the actual port numbers and the	 *     verification tag within the SCTP common header of the received	 *     packet. If these values do not match the packet MUST be silently	 *     discarded,	 */	if (ntohl(chunk->sctp_hdr->vtag) != bear_cookie->my_vtag) {		*error = -SCTP_IERROR_BAD_TAG;		goto fail;	}	if (ntohs(chunk->sctp_hdr->source) != bear_cookie->peer_addr.v4.sin_port ||	    ntohs(chunk->sctp_hdr->dest) != bear_cookie->my_port) {		*error = -SCTP_IERROR_BAD_PORTS;		goto fail;	}	/* Check to see if the cookie is stale.  If there is already	 * an association, there is no need to check cookie's expiration	 * for init collision case of lost COOKIE ACK.	 */	skb_get_timestamp(skb, &tv);	if (!asoc && tv_lt(bear_cookie->expiration, tv)) {		__u16 len;		/*		 * Section 3.3.10.3 Stale Cookie Error (3)		 *		 * Cause of error		 * ---------------		 * Stale Cookie Error:  Indicates the receipt of a valid State		 * Cookie that has expired.		 */		len = ntohs(chunk->chunk_hdr->length);		*errp = sctp_make_op_error_space(asoc, chunk, len);		if (*errp) {			suseconds_t usecs = (tv.tv_sec -				bear_cookie->expiration.tv_sec) * 1000000L +				tv.tv_usec - bear_cookie->expiration.tv_usec;			usecs = htonl(usecs);			sctp_init_cause(*errp, SCTP_ERROR_STALE_COOKIE,					&usecs, sizeof(usecs));			*error = -SCTP_IERROR_STALE_COOKIE;		} else			*error = -SCTP_IERROR_NOMEM;		goto fail;	}	/* Make a new base association.  */	scope = sctp_scope(sctp_source(chunk));	retval = sctp_association_new(ep, ep->base.sk, scope, gfp);	if (!retval) {		*error = -SCTP_IERROR_NOMEM;		goto fail;	}	/* Set up our peer's port number.  */	retval->peer.port = ntohs(chunk->sctp_hdr->source);	/* Populate the association from the cookie.  */	memcpy(&retval->c, bear_cookie, sizeof(*bear_cookie));	if (sctp_assoc_set_bind_addr_from_cookie(retval, bear_cookie,						 GFP_ATOMIC) < 0) {		*error = -SCTP_IERROR_NOMEM;		goto fail;	}	/* Also, add the destination address. */	if (list_empty(&retval->base.bind_addr.address_list)) {		sctp_add_bind_addr(&retval->base.bind_addr, &chunk->dest,				   GFP_ATOMIC);	}	retval->next_tsn = retval->c.initial_tsn;	retval->ctsn_ack_point = retval->next_tsn - 1;	retval->addip_serial = retval->c.initial_tsn;	retval->adv_peer_ack_point = retval->ctsn_ack_point;	retval->peer.prsctp_capable = retval->c.prsctp_capable;	retval->peer.adaption_ind = retval->c.adaption_ind;	/* The INIT stuff will be done by the side effects.  */	return retval;fail:	if (retval)		sctp_association_free(retval);	return NULL;malformed:	/* Yikes!  The packet is either corrupt or deliberately	 * malformed.	 */	*error = -SCTP_IERROR_MALFORMED;	goto fail;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/dd0fc66fb33cd610bc1a5db8a5e232d34879b4d7/sm_make_chunk.c/buggy/net/sctp/sm_make_chunk.c