Xin Long ecca8f88da sctp: set frag_point in sctp_setsockopt_maxseg correctly ... Now in sctp_setsockopt_maxseg user_frag or frag_point can be set with val >= 8 and val <= SCTP_MAX_CHUNK_LEN. But both checks are incorrect. val >= 8 means frag_point can even be less than SCTP_DEFAULT_MINSEGMENT. Then in sctp_datamsg_from_user(), when it's value is greater than cookie echo len and trying to bundle with cookie echo chunk, the first_len will overflow. The worse case is when it's value is equal as cookie echo len, first_len becomes 0, it will go into a dead loop for fragment later on. In Hangbin syzkaller testing env, oom was even triggered due to consecutive memory allocation in that loop. Besides, SCTP_MAX_CHUNK_LEN is the max size of the whole chunk, it should deduct the data header for frag_point or user_frag check. This patch does a proper check with SCTP_DEFAULT_MINSEGMENT subtracting the sctphdr and datahdr, SCTP_MAX_CHUNK_LEN subtracting datahdr when setting frag_point via sockopt. It also improves sctp_setsockopt_maxseg codes. Suggested-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Reported-by: Hangbin Liu <liuhangbin@gmail.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-11-18 10:32:41 +09:00
..
6lowpan	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
9p	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
802	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
8021q	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-12 09:17:05 +09:00
appletalk	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
atm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-11-15 11:56:19 -08:00
ax25	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
batman-adv	batman-adv: Avoid spurious warnings from bat_v neigh_cmp implementation	2017-10-17 08:09:47 +02:00
bluetooth	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
bpf	bpf: add meta pointer for direct access	2017-09-26 13:36:44 -07:00
bridge	net: bridge: add vlan_tunnel to bridge port policies	2017-11-14 21:54:55 +09:00
caif	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
can	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
ceph	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
core	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-11-15 11:56:19 -08:00
dcb
dccp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
decnet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-11-15 11:56:19 -08:00
dns_resolver	KEYS: Fix race between updating and finding a negative key	2017-10-18 09:12:40 +01:00
dsa	net: dsa: lan9303: calculate offload_fwd_mark from tag	2017-11-14 21:47:48 +09:00
ethernet
hsr	net: hsr: Convert timers to use timer_setup()	2017-10-25 13:00:27 +09:00
ieee802154	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
ife	MAINTAINERS: Update Yotam's E-mail	2017-11-01 12:19:03 +09:00
ipv4	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-11-15 11:56:19 -08:00
ipv6	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-11-15 11:56:19 -08:00
ipx	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
iucv
kcm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
key	af_key: replace BUG_ON on WARN_ON in net_exit hook	2017-11-14 15:45:52 +09:00
l2tp	l2tp: exit_net cleanup check added	2017-11-14 15:45:53 +09:00
l3mdev
lapb	net/lapb: Convert timers to use timer_setup()	2017-10-18 12:39:36 +01:00
llc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-11-15 11:56:19 -08:00
mac80211	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-11-15 11:56:19 -08:00
mac802154	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
mpls	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
ncsi	net/ncsi: Don't return error on normal response	2017-11-11 15:09:44 +09:00
netfilter	netfilter: add ifdef around ctnetlink_proto_size	2017-11-16 10:49:00 +09:00
netlabel	net/netlabel: Add list_next_rcu() in rcu_dereference().	2017-11-18 10:32:41 +09:00
netlink	netlink: remove unnecessary forward declaration	2017-11-14 21:51:14 +09:00
netrom	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-11-15 11:56:19 -08:00
nfc	genetlink: fix genlmsg_nlhdr()	2017-11-16 10:49:00 +09:00
nsh	openvswitch: enable NSH support	2017-11-08 16:12:33 +09:00
openvswitch	openvswitch: meter: fix NULL pointer dereference in ovs_meter_cmd_reply_start	2017-11-15 14:16:07 +09:00
packet	packet: exit_net cleanup check added	2017-11-14 15:45:52 +09:00
phonet	phonet: exit_net cleanup check added	2017-11-14 15:45:53 +09:00
psample	MAINTAINERS: Update Yotam's E-mail	2017-11-01 12:19:03 +09:00
qrtr	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-10 10:00:18 +09:00
rds	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-12 09:17:05 +09:00
rfkill
rose	net: rose: mark expected switch fall-throughs	2017-10-22 02:02:26 +01:00
rxrpc	RxRPC development	2017-11-14 16:17:38 +09:00
sched	netem: remove unnecessary 64 bit modulus	2017-11-15 14:14:16 +09:00
sctp	sctp: set frag_point in sctp_setsockopt_maxseg correctly	2017-11-18 10:32:41 +09:00
smc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
strparser	strparser: Use delayed work instead of timer for msg timeout	2017-10-25 10:37:11 +09:00
sunrpc	Modules updates for v4.15	2017-11-15 13:46:33 -08:00
switchdev	net: bridge: Add/del switchdev object on host join/leave	2017-11-10 13:41:40 +09:00
tipc	tipc: enforce valid ratio between skb truesize and contents	2017-11-16 10:49:00 +09:00
tls	tls: don't override sk_write_space if tls_set_sw_offload fails.	2017-11-14 16:26:35 +09:00
unix	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
vmw_vsock	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
wimax	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
wireless	genetlink: fix genlmsg_nlhdr()	2017-11-16 10:49:00 +09:00
x25	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-11-04 09:26:51 +09:00
xfrm	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec	2017-11-16 22:33:54 +09:00
compat.c	net: compat: assert the size of cmsg copied in is as expected	2017-09-20 15:36:18 -07:00
Kconfig
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
socket.c
sysctl_net.c