summaryrefslogtreecommitdiffstats
path: root/CREDITS
diff options
context:
space:
mode:
authorXin Long <lucien.xin@gmail.com>2017-11-17 14:11:11 +0800
committerDavid S. Miller <davem@davemloft.net>2017-11-18 10:32:41 +0900
commitecca8f88da5c4260cc2bccfefd2a24976704c366 (patch)
tree763c7eece0fe70691f21ce60d1f6b3ef8e6759b5 /CREDITS
parentd35ef8f846c72d84bfccf239c248c84f79c3a7e8 (diff)
downloadlinux-ecca8f88da5c4260cc2bccfefd2a24976704c366.tar.gz
linux-ecca8f88da5c4260cc2bccfefd2a24976704c366.tar.bz2
linux-ecca8f88da5c4260cc2bccfefd2a24976704c366.zip
sctp: set frag_point in sctp_setsockopt_maxseg correctly
Now in sctp_setsockopt_maxseg user_frag or frag_point can be set with val >= 8 and val <= SCTP_MAX_CHUNK_LEN. But both checks are incorrect. val >= 8 means frag_point can even be less than SCTP_DEFAULT_MINSEGMENT. Then in sctp_datamsg_from_user(), when it's value is greater than cookie echo len and trying to bundle with cookie echo chunk, the first_len will overflow. The worse case is when it's value is equal as cookie echo len, first_len becomes 0, it will go into a dead loop for fragment later on. In Hangbin syzkaller testing env, oom was even triggered due to consecutive memory allocation in that loop. Besides, SCTP_MAX_CHUNK_LEN is the max size of the whole chunk, it should deduct the data header for frag_point or user_frag check. This patch does a proper check with SCTP_DEFAULT_MINSEGMENT subtracting the sctphdr and datahdr, SCTP_MAX_CHUNK_LEN subtracting datahdr when setting frag_point via sockopt. It also improves sctp_setsockopt_maxseg codes. Suggested-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Reported-by: Hangbin Liu <liuhangbin@gmail.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'CREDITS')
0 files changed, 0 insertions, 0 deletions