* [PATCH] sctp: fix append error cause to ERROR chunk correctly
@ 2010-05-13 5:19 Wei Yongjun
2010-05-13 13:31 ` Neil Horman
2010-05-13 13:37 ` Vlad Yasevich
0 siblings, 2 replies; 5+ messages in thread
From: Wei Yongjun @ 2010-05-13 5:19 UTC (permalink / raw)
To: linux-sctp
commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809
sctp: Fix skb_over_panic resulting from multiple invalid \
parameter errors (CVE-2010-1173) (v4)
cause 'error cause' never be add the the ERROR chunk due to
some typo when check valid length in sctp_init_cause_fixed().
Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
---
net/sctp/sm_make_chunk.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 30c1767..70d6c10 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -141,7 +141,7 @@ int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code,
len = sizeof(sctp_errhdr_t) + paylen;
err.length = htons(len);
- if (skb_tailroom(chunk->skb) > len)
+ if (skb_tailroom(chunk->skb) < len)
return -ENOSPC;
chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk,
sizeof(sctp_errhdr_t),
@@ -1421,7 +1421,7 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk,
int len, const void *data)
{
- if (skb_tailroom(chunk->skb) > len)
+ if (skb_tailroom(chunk->skb) >= len)
return sctp_addto_chunk(chunk, len, data);
else
return NULL;
--
1.6.5.2
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] sctp: fix append error cause to ERROR chunk correctly
2010-05-13 5:19 [PATCH] sctp: fix append error cause to ERROR chunk correctly Wei Yongjun
@ 2010-05-13 13:31 ` Neil Horman
2010-05-13 13:37 ` Vlad Yasevich
1 sibling, 0 replies; 5+ messages in thread
From: Neil Horman @ 2010-05-13 13:31 UTC (permalink / raw)
To: linux-sctp
On Thu, May 13, 2010 at 01:19:29PM +0800, Wei Yongjun wrote:
> commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809
> sctp: Fix skb_over_panic resulting from multiple invalid \
> parameter errors (CVE-2010-1173) (v4)
>
> cause 'error cause' never be add the the ERROR chunk due to
> some typo when check valid length in sctp_init_cause_fixed().
>
> Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
> ---
> net/sctp/sm_make_chunk.c | 4 ++--
> 1 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
> index 30c1767..70d6c10 100644
> --- a/net/sctp/sm_make_chunk.c
> +++ b/net/sctp/sm_make_chunk.c
> @@ -141,7 +141,7 @@ int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code,
> len = sizeof(sctp_errhdr_t) + paylen;
> err.length = htons(len);
>
> - if (skb_tailroom(chunk->skb) > len)
> + if (skb_tailroom(chunk->skb) < len)
> return -ENOSPC;
> chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk,
> sizeof(sctp_errhdr_t),
> @@ -1421,7 +1421,7 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
> void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk,
> int len, const void *data)
> {
> - if (skb_tailroom(chunk->skb) > len)
> + if (skb_tailroom(chunk->skb) >= len)
> return sctp_addto_chunk(chunk, len, data);
> else
> return NULL;
Yup, thanks!
Reviewed-by: Neil Horman <nhorman@tuxdriver.com>
> --
> 1.6.5.2
>
>
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] sctp: fix append error cause to ERROR chunk correctly
2010-05-13 5:19 [PATCH] sctp: fix append error cause to ERROR chunk correctly Wei Yongjun
2010-05-13 13:31 ` Neil Horman
@ 2010-05-13 13:37 ` Vlad Yasevich
2010-05-14 0:37 ` Wei Yongjun
1 sibling, 1 reply; 5+ messages in thread
From: Vlad Yasevich @ 2010-05-13 13:37 UTC (permalink / raw)
To: linux-sctp
Neil Horman wrote:
> On Thu, May 13, 2010 at 01:19:29PM +0800, Wei Yongjun wrote:
>> commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809
>> sctp: Fix skb_over_panic resulting from multiple invalid \
>> parameter errors (CVE-2010-1173) (v4)
>>
>> cause 'error cause' never be add the the ERROR chunk due to
>> some typo when check valid length in sctp_init_cause_fixed().
>>
>> Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
>> ---
>> net/sctp/sm_make_chunk.c | 4 ++--
>> 1 files changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
>> index 30c1767..70d6c10 100644
>> --- a/net/sctp/sm_make_chunk.c
>> +++ b/net/sctp/sm_make_chunk.c
>> @@ -141,7 +141,7 @@ int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code,
>> len = sizeof(sctp_errhdr_t) + paylen;
>> err.length = htons(len);
>>
>> - if (skb_tailroom(chunk->skb) > len)
>> + if (skb_tailroom(chunk->skb) < len)
>> return -ENOSPC;
>> chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk,
>> sizeof(sctp_errhdr_t),
>> @@ -1421,7 +1421,7 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
>> void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk,
>> int len, const void *data)
>> {
>> - if (skb_tailroom(chunk->skb) > len)
>> + if (skb_tailroom(chunk->skb) >= len)
>> return sctp_addto_chunk(chunk, len, data);
>> else
>> return NULL;
> Yup, thanks!
> Reviewed-by: Neil Horman <nhorman@tuxdriver.com>
>
Yikes.. Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Please submit to netdev with all updated attributions.
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH] sctp: fix append error cause to ERROR chunk correctly
2010-05-13 13:37 ` Vlad Yasevich
@ 2010-05-14 0:37 ` Wei Yongjun
0 siblings, 0 replies; 5+ messages in thread
From: Wei Yongjun @ 2010-05-14 0:37 UTC (permalink / raw)
To: David Miller
Cc: Vlad Yasevich, Neil Horman, linux-sctp, Eugene Teo,
netdev@vger.kernel.org
commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809
sctp: Fix skb_over_panic resulting from multiple invalid \
parameter errors (CVE-2010-1173) (v4)
cause 'error cause' never be add the the ERROR chunk due to
some typo when check valid length in sctp_init_cause_fixed().
Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Reviewed-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com>
---
net/sctp/sm_make_chunk.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 30c1767..70d6c10 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -141,7 +141,7 @@ int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code,
len = sizeof(sctp_errhdr_t) + paylen;
err.length = htons(len);
- if (skb_tailroom(chunk->skb) > len)
+ if (skb_tailroom(chunk->skb) < len)
return -ENOSPC;
chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk,
sizeof(sctp_errhdr_t),
@@ -1421,7 +1421,7 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk,
int len, const void *data)
{
- if (skb_tailroom(chunk->skb) > len)
+ if (skb_tailroom(chunk->skb) >= len)
return sctp_addto_chunk(chunk, len, data);
else
return NULL;
--
1.6.5.2
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH] sctp: fix append error cause to ERROR chunk correctly
@ 2010-05-14 0:37 ` Wei Yongjun
0 siblings, 0 replies; 5+ messages in thread
From: Wei Yongjun @ 2010-05-14 0:37 UTC (permalink / raw)
To: David Miller
Cc: Vlad Yasevich, Neil Horman, linux-sctp, Eugene Teo,
netdev@vger.kernel.org
commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809
sctp: Fix skb_over_panic resulting from multiple invalid \
parameter errors (CVE-2010-1173) (v4)
cause 'error cause' never be add the the ERROR chunk due to
some typo when check valid length in sctp_init_cause_fixed().
Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Reviewed-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com>
---
net/sctp/sm_make_chunk.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 30c1767..70d6c10 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -141,7 +141,7 @@ int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code,
len = sizeof(sctp_errhdr_t) + paylen;
err.length = htons(len);
- if (skb_tailroom(chunk->skb) > len)
+ if (skb_tailroom(chunk->skb) < len)
return -ENOSPC;
chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk,
sizeof(sctp_errhdr_t),
@@ -1421,7 +1421,7 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk,
int len, const void *data)
{
- if (skb_tailroom(chunk->skb) > len)
+ if (skb_tailroom(chunk->skb) >= len)
return sctp_addto_chunk(chunk, len, data);
else
return NULL;
--
1.6.5.2
^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2010-05-14 0:39 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-05-13 5:19 [PATCH] sctp: fix append error cause to ERROR chunk correctly Wei Yongjun
2010-05-13 13:31 ` Neil Horman
2010-05-13 13:37 ` Vlad Yasevich
2010-05-14 0:37 ` Wei Yongjun
2010-05-14 0:37 ` Wei Yongjun
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.