]> git.baikalelectronics.ru Git - kernel.git/commit
sctp: validate chunk len before actually using it
authorMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Tue, 25 Oct 2016 16:27:39 +0000 (14:27 -0200)
committerDavid S. Miller <davem@davemloft.net>
Sat, 29 Oct 2016 16:00:10 +0000 (12:00 -0400)
commit9628c413982653342f9b22aae69c336ffbb17719
tree1b27244b2383e75616e7c1d4a3c1faa329108f99
parent72cead573bb5a33bbf5aafd085a4b6a1ca848f55
sctp: validate chunk len before actually using it

Andrey Konovalov reported that KASAN detected that SCTP was using a slab
beyond the boundaries. It was caused because when handling out of the
blue packets in function sctp_sf_ootb() it was checking the chunk len
only after already processing the first chunk, validating only for the
2nd and subsequent ones.

The fix is to just move the check upwards so it's also validated for the
1st chunk.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/sctp/sm_statefuns.c