linux-stable/net/sctp
Xin Long ecca8f88da sctp: set frag_point in sctp_setsockopt_maxseg correctly
Now in sctp_setsockopt_maxseg user_frag or frag_point can be set with
val >= 8 and val <= SCTP_MAX_CHUNK_LEN. But both checks are incorrect.

val >= 8 means frag_point can even be less than SCTP_DEFAULT_MINSEGMENT.
Then in sctp_datamsg_from_user(), when it's value is greater than cookie
echo len and trying to bundle with cookie echo chunk, the first_len will
overflow.

The worse case is when it's value is equal as cookie echo len, first_len
becomes 0, it will go into a dead loop for fragment later on. In Hangbin
syzkaller testing env, oom was even triggered due to consecutive memory
allocation in that loop.

Besides, SCTP_MAX_CHUNK_LEN is the max size of the whole chunk, it should
deduct the data header for frag_point or user_frag check.

This patch does a proper check with SCTP_DEFAULT_MINSEGMENT subtracting
the sctphdr and datahdr, SCTP_MAX_CHUNK_LEN subtracting datahdr when
setting frag_point via sockopt. It also improves sctp_setsockopt_maxseg
codes.

Suggested-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Reported-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-11-18 10:32:41 +09:00
..
associola.c net: sctp: Convert timers to use timer_setup() 2017-10-25 12:02:09 +09:00
auth.c sctp: remove the typedef sctp_hmac_algo_param_t 2017-07-16 20:52:14 -07:00
bind_addr.c sctp: remove the typedef sctp_scope_t 2017-08-06 21:33:41 -07:00
chunk.c sctp: introduce struct sctp_stream_out_ext 2017-10-03 16:27:28 -07:00
debug.c sctp: remove the typedef sctp_subtype_t 2017-08-06 21:33:42 -07:00
endpointola.c sctp: remove the typedef sctp_subtype_t 2017-08-06 21:33:42 -07:00
input.c sctp: fix some type cast warnings introduced by transport rhashtable 2017-10-29 18:03:24 +09:00
inqueue.c sctp: remove the typedef sctp_chunkhdr_t 2017-07-01 09:08:41 -07:00
ipv6.c net/sctp: Always set scope_id in sctp_inet6_skb_msgname 2017-11-16 23:00:30 +09:00
Kconfig sctp: add the sctp_diag.c file 2016-04-15 17:29:36 -04:00
Makefile Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-11-04 09:26:51 +09:00
objcnt.c sctp: remove the typedef sctp_dbg_objcnt_entry_t 2017-08-11 10:02:43 -07:00
offload.c net: use skb->csum_not_inet to identify packets needing crc32c 2017-05-19 19:21:29 -04:00
output.c sctp: remove the typedef sctp_xmit_t 2017-08-06 21:33:42 -07:00
outqueue.c sctp: introduce stream scheduler foundations 2017-10-03 16:27:29 -07:00
primitive.c sctp: remove the typedef sctp_subtype_t 2017-08-06 21:33:42 -07:00
probe.c sctp: remove the typedef sctp_disposition_t 2017-08-11 10:02:44 -07:00
proc.c net: convert sock.sk_wmem_alloc from atomic_t to refcount_t 2017-07-01 07:39:08 -07:00
protocol.c net: sctp: Convert timers to use timer_setup() 2017-10-25 12:02:09 +09:00
sctp_diag.c sctp: Fix a big endian bug in sctp_diag_dump() 2017-09-26 21:16:29 -07:00
sm_make_chunk.c sctp: check stream reset info len before making reconf chunk 2017-11-16 10:49:00 +09:00
sm_sideeffect.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-10-30 21:09:24 +09:00
sm_statefuns.c sctp: remove the typedef sctp_disposition_t 2017-08-11 10:02:44 -07:00
sm_statetable.c sctp: remove the typedef sctp_sm_table_entry_t 2017-08-11 10:02:44 -07:00
socket.c sctp: set frag_point in sctp_setsockopt_maxseg correctly 2017-11-18 10:32:41 +09:00
stream.c sctp: check stream reset info len before making reconf chunk 2017-11-16 10:49:00 +09:00
stream_sched.c sctp: make array sctp_sched_ops static 2017-10-11 20:18:25 -07:00
stream_sched_prio.c sctp: introduce priority based stream scheduler 2017-10-03 16:27:29 -07:00
stream_sched_rr.c sctp: introduce round robin stream scheduler 2017-10-03 16:27:29 -07:00
sysctl.c sctp: remove the typedef sctp_scope_policy_t 2017-08-06 21:33:41 -07:00
transport.c net: sctp: Convert timers to use timer_setup() 2017-10-25 12:02:09 +09:00
tsnmap.c
ulpevent.c sctp: fix some type cast warnings introduced by stream reconf 2017-10-29 18:03:24 +09:00
ulpqueue.c sctp: fix missing wake ups in some situations 2017-09-08 10:02:47 -07:00