{"id":813665,"url":"http://patchwork.ozlabs.org/api/patches/813665/?format=json","web_url":"http://patchwork.ozlabs.org/project/netdev/patch/20170913230054.fmtidvfi2swvy2mm@mwanda/","project":{"id":7,"url":"http://patchwork.ozlabs.org/api/projects/7/?format=json","name":"Linux network development","link_name":"netdev","list_id":"netdev.vger.kernel.org","list_email":"netdev@vger.kernel.org","web_url":null,"scm_url":null,"webscm_url":null,"list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20170913230054.fmtidvfi2swvy2mm@mwanda>","list_archive_url":null,"date":"2017-09-13T23:00:54","name":"[v2,net] sctp: potential read out of bounds in sctp_ulpevent_type_enabled()","commit_ref":null,"pull_url":null,"state":"accepted","archived":true,"hash":"b06867a9e6eb1aa5ce12b854dee577cd47ef5a9a","submitter":{"id":9327,"url":"http://patchwork.ozlabs.org/api/people/9327/?format=json","name":"Dan Carpenter","email":"dan.carpenter@oracle.com"},"delegate":{"id":34,"url":"http://patchwork.ozlabs.org/api/users/34/?format=json","username":"davem","first_name":"David","last_name":"Miller","email":"davem@davemloft.net"},"mbox":"http://patchwork.ozlabs.org/project/netdev/patch/20170913230054.fmtidvfi2swvy2mm@mwanda/mbox/","series":[{"id":2995,"url":"http://patchwork.ozlabs.org/api/series/2995/?format=json","web_url":"http://patchwork.ozlabs.org/project/netdev/list/?series=2995","date":"2017-09-13T23:00:54","name":"[v2,net] sctp: potential read out of bounds in sctp_ulpevent_type_enabled()","version":2,"mbox":"http://patchwork.ozlabs.org/series/2995/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/813665/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/813665/checks/","tags":{},"related":[],"headers":{"Return-Path":"","X-Original-To":"patchwork-incoming@ozlabs.org","Delivered-To":"patchwork-incoming@ozlabs.org","Authentication-Results":"ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netdev-owner@vger.kernel.org;\n\treceiver=)","Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xsxyF6cDjz9sxR\n\tfor ;\n\tThu, 14 Sep 2017 09:02:29 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1751419AbdIMXC0 (ORCPT );\n\tWed, 13 Sep 2017 19:02:26 -0400","from aserp1040.oracle.com ([141.146.126.69]:41018 \"EHLO\n\taserp1040.oracle.com\" rhost-flags-OK-OK-OK-OK) by vger.kernel.org\n\twith ESMTP id S1751125AbdIMXCZ (ORCPT\n\t); Wed, 13 Sep 2017 19:02:25 -0400","from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71])\n\tby aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with\n\tESMTP id v8DN1EVD030739\n\t(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256\n\tverify=OK); Wed, 13 Sep 2017 23:01:15 GMT","from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236])\n\tby userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id\n\tv8DN1DwL025290\n\t(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256\n\tverify=OK); Wed, 13 Sep 2017 23:01:14 GMT","from ubhmp0013.oracle.com (ubhmp0013.oracle.com [156.151.24.66])\n\tby aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v8DN18DO015231; \n\tWed, 13 Sep 2017 23:01:08 GMT","from mwanda (/41.202.241.15)\n\tby default (Oracle Beehive Gateway v4.0)\n\twith ESMTP ; Wed, 13 Sep 2017 23:01:07 +0000"],"Date":"Thu, 14 Sep 2017 02:00:54 +0300","From":"Dan Carpenter ","To":"Vlad Yasevich ","Cc":"Neil Horman ,\n\t\"David S. Miller\" ,\n\tlinux-sctp@vger.kernel.org, netdev@vger.kernel.org,\n\tkernel-janitors@vger.kernel.org","Subject":"[PATCH v2 net] sctp: potential read out of bounds in\n\tsctp_ulpevent_type_enabled()","Message-ID":"<20170913230054.fmtidvfi2swvy2mm@mwanda>","MIME-Version":"1.0","Content-Type":"text/plain; charset=us-ascii","Content-Disposition":"inline","In-Reply-To":"<20170913.092522.934509429497822082.davem@davemloft.net>","X-Mailer":"git-send-email haha only kidding","User-Agent":"NeoMutt/20170609 (1.8.3)","X-Source-IP":"userv0021.oracle.com [156.151.31.71]","Sender":"netdev-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"netdev@vger.kernel.org"},"content":"This code causes a static checker warning because Smatch doesn't trust\nanything that comes from skb->data. I've reviewed this code and I do\nthink skb->data can be controlled by the user here.\n\nThe sctp_event_subscribe struct has 13 __u8 fields and we want to see\nif ours is non-zero. sn_type can be any value in the 0-USHRT_MAX range.\nWe're subtracting SCTP_SN_TYPE_BASE which is 1 << 15 so we could read\neither before the start of the struct or after the end.\n\nThis is a very old bug and it's surprising that it would go undetected\nfor so long but my theory is that it just doesn't have a big impact so\nit would be hard to notice.\n\nSigned-off-by: Dan Carpenter \n---\nv2: Use reverse-christmas-tree local variable ordering.","diff":"diff --git a/include/net/sctp/ulpevent.h b/include/net/sctp/ulpevent.h\nindex 1060494ac230..b8c86ec1a8f5 100644\n--- a/include/net/sctp/ulpevent.h\n+++ b/include/net/sctp/ulpevent.h\n@@ -153,8 +153,12 @@ __u16 sctp_ulpevent_get_notification_type(const struct sctp_ulpevent *event);\n static inline int sctp_ulpevent_type_enabled(__u16 sn_type,\n \t\t\t\t\t struct sctp_event_subscribe *mask)\n {\n+\tint offset = sn_type - SCTP_SN_TYPE_BASE;\n \tchar *amask = (char *) mask;\n-\treturn amask[sn_type - SCTP_SN_TYPE_BASE];\n+\n+\tif (offset >= sizeof(struct sctp_event_subscribe))\n+\t\treturn 0;\n+\treturn amask[offset];\n }\n \n /* Given an event subscription, is this event enabled? */\n","prefixes":["v2","net"]}