From patchwork Fri Aug 22 19:00:37 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kamal Mostafa X-Patchwork-Id: 382326 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id 760DC14007D; Sat, 23 Aug 2014 05:01:02 +1000 (EST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1XKu55-0001Vo-Eq; Fri, 22 Aug 2014 19:00:59 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1XKu4o-0001Qf-1z for kernel-team@lists.ubuntu.com; Fri, 22 Aug 2014 19:00:42 +0000 Received: from c-67-160-228-185.hsd1.ca.comcast.net ([67.160.228.185] helo=fourier) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1XKu4l-0002jx-Lo; Fri, 22 Aug 2014 19:00:40 +0000 Received: from kamal by fourier with local (Exim 4.82) (envelope-from ) id 1XKu4j-0003vr-Jp; Fri, 22 Aug 2014 12:00:37 -0700 From: Kamal Mostafa To: Xufeng Zhang Subject: [3.8.y.z extended stable] Patch "sctp: Fix sk_ack_backlog wrap-around problem" has been added to staging queue Date: Fri, 22 Aug 2014 12:00:37 -0700 Message-Id: <1408734037-15084-1-git-send-email-kamal@canonical.com> X-Mailer: git-send-email 1.9.1 X-Extended-Stable: 3.8 Cc: Kamal Mostafa , Daniel Borkmann , kernel-team@lists.ubuntu.com, Vlad Yasevich , "David S. Miller" X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com This is a note to let you know that I have just added a patch titled sctp: Fix sk_ack_backlog wrap-around problem to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree which can be found at: http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue This patch is scheduled to be released in version 3.8.13.28. If you, or anyone else, feels it should not be added to this tree, please reply to this email. For more information about the 3.8.y.z tree, see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable Thanks. -Kamal ------ From 99e72d9912f2f140755f9c87b3f96a85cff1f2af Mon Sep 17 00:00:00 2001 From: Xufeng Zhang Date: Thu, 12 Jun 2014 10:53:36 +0800 Subject: sctp: Fix sk_ack_backlog wrap-around problem commit d3217b15a19a4779c39b212358a5c71d725822ee upstream. Consider the scenario: For a TCP-style socket, while processing the COOKIE_ECHO chunk in sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check, a new association would be created in sctp_unpack_cookie(), but afterwards, some processing maybe failed, and sctp_association_free() will be called to free the previously allocated association, in sctp_association_free(), sk_ack_backlog value is decremented for this socket, since the initial value for sk_ack_backlog is 0, after the decrement, it will be 65535, a wrap-around problem happens, and if we want to establish new associations afterward in the same socket, ABORT would be triggered since sctp deem the accept queue as full. Fix this issue by only decrementing sk_ack_backlog for associations in the endpoint's list. Fix-suggested-by: Neil Horman Signed-off-by: Xufeng Zhang Acked-by: Daniel Borkmann Acked-by: Vlad Yasevich Signed-off-by: David S. Miller Reference: CVE-2014-4667 Signed-off-by: Kamal Mostafa --- net/sctp/associola.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 1.9.1 diff --git a/net/sctp/associola.c b/net/sctp/associola.c index 67c6823..c5cd799 100644 --- a/net/sctp/associola.c +++ b/net/sctp/associola.c @@ -396,7 +396,7 @@ void sctp_association_free(struct sctp_association *asoc) /* Only real associations count against the endpoint, so * don't bother for if this is a temporary association. */ - if (!asoc->temp) { + if (!list_empty(&asoc->asocs)) { list_del(&asoc->asocs); /* Decrement the backlog value for a TCP-style listening