Re: [PATCH] [SCTP]: Add address type check while process paramaters

[Patrick McHardy <kaber@trash.net>]

[-- Attachment #1: Type: text/plain, Size: 731 bytes --]

Vlad Yasevich wrote:
> @@ -2827,6 +2827,19 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
>  	union sctp_addr	addr;
>  	union sctp_addr_param *addr_param;
>  
> +	switch (addr_param->v4.param_hdr.type) {

^^^ use of addr_param

> +	case SCTP_PARAM_IPV6_ADDRESS:
> +		if (!asoc->peer.ipv6_address)
> +			return SCTP_ERROR_INV_PARAM;
> +		break;
> +	case SCTP_PARAM_IPV4_ADDRESS:
> +		if (!asoc->peer.ipv4_address)
> +			return SCTP_ERROR_INV_PARAM;
> +		break;
> +	default:
> +		return SCTP_ERROR_INV_PARAM;
> +	}
> +
>  	addr_param = (union sctp_addr_param *)
>  			((void *)asconf_param + sizeof(sctp_addip_param_t));

^^^ initialization of addr_param

The patch is wrong and needs this fix on top.





[-- Attachment #2: x --]
[-- Type: text/plain, Size: 1465 bytes --]

commit 1beb4530b5bf180d8989993d3050fabdf21522cc
Author: Patrick McHardy <kaber@trash.net>
Date:   Tue May 13 13:27:22 2008 +0200

    [SCTP]: Fix use of uninitialized pointer
    
    Introduced by c4492586 (sctp: Add address type check while process
    paramaters of ASCONF chunk):
    
    net/sctp/sm_make_chunk.c: In function 'sctp_process_asconf':
    net/sctp/sm_make_chunk.c:2828: warning: 'addr_param' may be used uninitialized in this function
    net/sctp/sm_make_chunk.c:2828: note: 'addr_param' was declared here
    
    Signed-off-by: Patrick McHardy <kaber@trash.net>

diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 6eeee53..bbc7107 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2827,6 +2827,9 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
 	union sctp_addr	addr;
 	union sctp_addr_param *addr_param;
 
+	addr_param = (union sctp_addr_param *)
+			((void *)asconf_param + sizeof(sctp_addip_param_t));
+
 	switch (addr_param->v4.param_hdr.type) {
 	case SCTP_PARAM_IPV6_ADDRESS:
 		if (!asoc->peer.ipv6_address)
@@ -2840,9 +2843,6 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
 		return SCTP_ERROR_INV_PARAM;
 	}
 
-	addr_param = (union sctp_addr_param *)
-			((void *)asconf_param + sizeof(sctp_addip_param_t));
-
 	af = sctp_get_af_specific(param_type2af(addr_param->v4.param_hdr.type));
 	if (unlikely(!af))
 		return SCTP_ERROR_INV_PARAM;