kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-01 18:21:29 +00:00
Code Issues Releases Packages Activity
linux/net/sctp
History
Xin Long 5c9367ac5a sctp: fix a potential overflow in sctp_ifwdtsn_skip 
[ Upstream commit 32832a2caf ]

Currently, when traversing ifwdtsn skips with _sctp_walk_ifwdtsn, it only
checks the pos against the end of the chunk. However, the data left for
the last pos may be < sizeof(struct sctp_ifwdtsn_skip), and dereference
it as struct sctp_ifwdtsn_skip may cause coverflow.

This patch fixes it by checking the pos against "the end of the chunk -
sizeof(struct sctp_ifwdtsn_skip)" in sctp_ifwdtsn_skip, similar to
sctp_fwdtsn_skip.

Fixes: 0fc2ea922c ("sctp: implement validate_ftsn for sctp_stream_interleave")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Link: https://lore.kernel.org/r/2a71bffcd80b4f2c61fac6d344bb2f11c8fd74f7.1681155810.git.lucien.xin@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2023-04-20 12:35:09 +02:00
..
associola.c sctp: leave the err path free in sctp_stream_init to sctp_stream_free 2022-07-27 18:23:22 -07:00
auth.c sctp: handle the error returned from sctp_auth_asoc_init_active_key 2022-09-30 12:36:40 +01:00
bind_addr.c sctp: fail if no bound addresses can be used for a given scope 2023-02-01 08:34:46 +01:00
chunk.c net: sctp: chunk.c: delete duplicated word 2020-08-24 16:21:43 -07:00
debug.c sctp: add the probe timer in transport for PLPMTUD 2021-06-22 11:28:52 -07:00
diag.c sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list 2023-02-22 12:59:51 +01:00
endpointola.c sctp: use call_rcu to free endpoint 2021-12-25 17:13:37 +00:00
input.c sctp: read sk->sk_bound_dev_if once in sctp_rcv() 2022-05-16 10:31:06 +01:00
inqueue.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 104 2019-05-24 17:39:00 +02:00
ipv6.c ipv6: Remove __ipv6_only_sock(). 2022-04-22 12:47:50 +01:00
Kconfig sctp: create udp4 sock and add its encap_rcv 2020-10-30 15:23:52 -07:00
Makefile sctp: rename sctp_diag.c as diag.c 2018-02-13 13:56:31 -05:00
objcnt.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 104 2019-05-24 17:39:00 +02:00
offload.c sctp: remove the NETIF_F_SG flag before calling skb_segment 2021-01-16 19:05:59 -08:00
output.c net: allow gso_max_size to exceed 65536 2022-05-16 10:18:55 +01:00
outqueue.c sctp: clear out_curr if all frag chunks of current msg are pruned 2022-11-07 19:59:01 -08:00
primitive.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 104 2019-05-24 17:39:00 +02:00
proc.c sctp: move hlist_node and hashent out of sctp_ep_common 2021-12-23 11:15:30 +00:00
protocol.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-07-21 13:03:39 -07:00
sm_make_chunk.c sctp: account stream padding length for reconf chunk 2021-10-14 07:15:22 -07:00
sm_sideeffect.c sctp: check asoc strreset_chunk in sctp_generate_reconf_event 2022-04-23 22:34:17 +01:00
sm_statefuns.c net: keep sk->sk_forward_alloc as small as possible 2022-06-10 16:21:27 -07:00
sm_statetable.c sctp: add the probe timer in transport for PLPMTUD 2021-06-22 11:28:52 -07:00
socket.c sctp: check send stream number after wait_for_sndbuf 2023-04-13 16:55:21 +02:00
stream.c sctp: fix memory leak in sctp_stream_outq_migrate() 2022-11-29 08:30:50 -08:00
stream_interleave.c sctp: fix a potential overflow in sctp_ifwdtsn_skip 2023-04-20 12:35:09 +02:00
stream_sched.c sctp: fix memory leak in sctp_stream_outq_migrate() 2022-11-29 08:30:50 -08:00
stream_sched_prio.c sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop 2023-03-11 13:55:26 +01:00
stream_sched_rr.c sctp: fix memory leak in sctp_stream_outq_migrate() 2022-11-29 08:30:50 -08:00
sysctl.c sctp: sysctl: make extra pointers netns aware 2022-12-31 13:32:28 +01:00
transport.c sctp: do not check hb_timer.expires when resetting hb_timer 2023-02-09 11:28:09 +01:00
tsnmap.c net: sctp: trivial: fix typo in comment 2021-03-04 13:48:32 -08:00
ulpevent.c net: remove noblock parameter from recvmsg() entities 2022-04-12 15:00:25 +02:00
ulpqueue.c net: keep sk->sk_forward_alloc as small as possible 2022-06-10 16:21:27 -07:00