]> git.baikalelectronics.ru Git - kernel.git/commit
sctp: fix the issue that pathmtu may be set lower than MINSEGMENT
authorXin Long <lucien.xin@gmail.com>
Tue, 3 Jul 2018 08:30:47 +0000 (16:30 +0800)
committerDavid S. Miller <davem@davemloft.net>
Wed, 4 Jul 2018 12:36:34 +0000 (21:36 +0900)
commit7befd674b93f0c265b6bfc2990638147e151d198
treee9baa17b87ed0c2449bb42d1ed96d4faa8ad8333
parenta1df03c6b44285984cc68bac824e7b399643e778
sctp: fix the issue that pathmtu may be set lower than MINSEGMENT

After commit 0e7e14df978c ("sctp: fix the handling of ICMP Frag Needed
for too small MTUs"), sctp_transport_update_pmtu would refetch pathmtu
from the dst and set it to transport's pathmtu without any check.

The new pathmtu may be lower than MINSEGMENT if the dst is obsolete and
updated by .get_dst() in sctp_transport_update_pmtu. In this case, it
could have a smaller MTU as well, and thus we should validate it
against MINSEGMENT instead.

Syzbot reported a warning in sctp_mtu_payload caused by this.

This patch refetches the pathmtu by calling sctp_dst_mtu where it does
the check against MINSEGMENT.

v1->v2:
  - refetch the pathmtu by calling sctp_dst_mtu instead as Marcelo's
    suggestion.

Fixes: 0e7e14df978c ("sctp: fix the handling of ICMP Frag Needed for too small MTUs")
Reported-by: syzbot+f0d9d7cba052f9344b03@syzkaller.appspotmail.com
Suggested-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/sctp/transport.c