From patchwork Fri Jul 14 14:07:33 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Xin Long X-Patchwork-Id: 788537 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3x8DzR0CWjz9s72 for ; Sat, 15 Jul 2017 00:07:47 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="HcUfO/FO"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754512AbdGNOHo (ORCPT ); Fri, 14 Jul 2017 10:07:44 -0400 Received: from mail-pf0-f196.google.com ([209.85.192.196]:34692 "EHLO mail-pf0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754191AbdGNOHn (ORCPT ); Fri, 14 Jul 2017 10:07:43 -0400 Received: by mail-pf0-f196.google.com with SMTP id c24so11162358pfe.1; Fri, 14 Jul 2017 07:07:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=f7ReWBxTBV1zMHoagIWs/k9KOMaIU9abWic+6GpnK3E=; b=HcUfO/FOT01M485eZ+Y2gtWtnCA4gldtl2qdq78SGM3khfMbSIMKsdBLE/vmB+n82H worrndiXwJoZymyU0pOtGjgxFpgfZyy/mLLN3IqGHUaOqgjzTTwRNtrP27k7YnH2KuRO 0D9J4d+kzqbcdF6Ft9dOWlvR0AAsD1XItZreF6H17Nc6lTvZ7PE74q+nOTkVnJ90/hfM 2WJkAqONv2juWuP3J4xlzSV/G9eNlQOUXkY5Mq+otqd0lTuaU3aDs60i3x+Rd6Qvd1qP YvMa7KGbPNORwZ5iXmgYizOcXOg5gVg+B3NHafp9sAtqz/TviAKmvfV4nv+0Y12fDEuC qd0Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=f7ReWBxTBV1zMHoagIWs/k9KOMaIU9abWic+6GpnK3E=; b=D6eNWixU+tUvuxBl6226pntJUIcZsXs5+bJqltE3L+KTeHCIWy/gEN5gxU6BZ7ow58 TUBvi6F3wzh9uEcy6HL+PL3Nf6TFSdlgLfzltE1OSxzYjO7g0mv6FPcSs51K67zLNGL5 Jah5MqUct2CzZMDwur4GqD4/nAGoZnvyIVKEYeyLlS9pdYBt5erHMInRKC0Q6W6dfMzh msg5kleACUD+ooHBkv9xWcURWRA9j2+PH16+r1neUz6oAmn+oEv0JS2dluMSZVkLkFv3 AYUTCa9PxXcLA75KZk4BclTSv2IUKCQNOnX+n5I6U2hLdRCulBTwuaFsvV+1uPvFBp9N 8ImQ== X-Gm-Message-State: AIVw113drdZZ6q3AgjlmGUYLC1UzmjvkFwFdjebWKeAY7QUCcb58ToN7 A5JRIhbPawS4FLb9fYM= X-Received: by 10.84.218.134 with SMTP id r6mr16137626pli.49.1500041262112; Fri, 14 Jul 2017 07:07:42 -0700 (PDT) Received: from localhost ([209.132.188.80]) by smtp.gmail.com with ESMTPSA id n74sm21805590pfh.118.2017.07.14.07.07.40 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 14 Jul 2017 07:07:41 -0700 (PDT) From: Xin Long To: network dev , linux-sctp@vger.kernel.org Cc: davem@davemloft.net, Marcelo Ricardo Leitner , Neil Horman Subject: [PATCH net] sctp: fix an array overflow when all ext chunks are set Date: Fri, 14 Jul 2017 22:07:33 +0800 Message-Id: <3e78f6040b834ee9221cd2ebf539324499a8bb4f.1500041253.git.lucien.xin@gmail.com> X-Mailer: git-send-email 2.1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Marcelo noticed an array overflow caused by commit c28445c3cb07 ("sctp: add reconf_enable in asoc ep and netns"), in which sctp would add SCTP_CID_RECONF into extensions when reconf_enable is set in sctp_make_init and sctp_make_init_ack. Then now when all ext chunks are set, 4 ext chunk ids can be put into extensions array while extensions array size is 3. It would cause a kernel panic because of this overflow. This patch is to fix it by defining extensions array size is 4 in both sctp_make_init and sctp_make_init_ack. Fixes: c28445c3cb07 ("sctp: add reconf_enable in asoc ep and netns") Signed-off-by: Xin Long --- net/sctp/sm_make_chunk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c index 4e16b02..6110447 100644 --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -228,7 +228,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc, sctp_adaptation_ind_param_t aiparam; sctp_supported_ext_param_t ext_param; int num_ext = 0; - __u8 extensions[3]; + __u8 extensions[4]; struct sctp_paramhdr *auth_chunks = NULL, *auth_hmacs = NULL; @@ -396,7 +396,7 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc, sctp_adaptation_ind_param_t aiparam; sctp_supported_ext_param_t ext_param; int num_ext = 0; - __u8 extensions[3]; + __u8 extensions[4]; struct sctp_paramhdr *auth_chunks = NULL, *auth_hmacs = NULL, *auth_random = NULL;