1.0.16 sctp_connectx() in 32 bit

1.0.16 sctp_connectx() in 32 bit

[Dong Liu]

Hi,

I think I found a problem in the new sctp_connectx() code.

in sctp_connectx3() there are,

     struct sctp_getaddrs_old param;
     socklen_t opt_len = sizeof(param);
     status getsockopt(fd, SOL_SCTP, SCTP_SOCKOPT_CONNECTX3, &param, 
&opt_len);

And in kernel net/sctp/socket.c sctp_getsockopt_connectx3(), there is a 
check,

             if (len < sizeof(param)) |
                 return 
-EINVAL;                                                         |

But struct sctp_getaddrs_old contains a pointer . When compiled in 32 
bit or 64 bit, the size of sctp_getaddrs_old is different. So if the 
kernel is in 64 bit mode but the libsctp is in 32 bit mode. 
sctp_connectx() will fail with EINVAL.

Thanks,

Dong

Re: 1.0.16 sctp_connectx() in 32 bit

[Daniel Borkmann]

On 03/13/2014 03:30 AM, Dong Liu wrote:
> Hi,
>
> I think I found a problem in the new sctp_connectx() code.
>
> in sctp_connectx3() there are,
>
>      struct sctp_getaddrs_old param;
>      socklen_t opt_len = sizeof(param);
>      status getsockopt(fd, SOL_SCTP, SCTP_SOCKOPT_CONNECTX3, &param, &opt_len);
>
> And in kernel net/sctp/socket.c sctp_getsockopt_connectx3(), there is a check,
>
>              if (len < sizeof(param)) |
>                  return -EINVAL;                                                         |
>
> But struct sctp_getaddrs_old contains a pointer . When compiled in 32 bit or 64 bit,
 > the size of sctp_getaddrs_old is different. So if the kernel is in 64 bit mode but
 > the libsctp is in 32 bit mode. sctp_connectx() will fail with EINVAL.

Kernel issue already fixed in:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?idÿd5939381c609056b33b7585fb05a77b4c695f3

> Thanks,
>
> Dong

Re: 1.0.16 sctp_connectx() in 32 bit

[Dong Liu]

On 3/13/14, 4:54 AM, Daniel Borkmann wrote:
> On 03/13/2014 03:30 AM, Dong Liu wrote:
>> Hi,
>>
>> I think I found a problem in the new sctp_connectx() code.
>>
>> in sctp_connectx3() there are,
>>
>>      struct sctp_getaddrs_old param;
>>      socklen_t opt_len = sizeof(param);
>>      status getsockopt(fd, SOL_SCTP, SCTP_SOCKOPT_CONNECTX3, &param, 
>> &opt_len);
>>
>> And in kernel net/sctp/socket.c sctp_getsockopt_connectx3(), there is 
>> a check,
>>
>>              if (len < sizeof(param)) |
>>                  return -EINVAL; |
>>
>> But struct sctp_getaddrs_old contains a pointer . When compiled in 32 
>> bit or 64 bit,
> > the size of sctp_getaddrs_old is different. So if the kernel is in 
> 64 bit mode but
> > the libsctp is in 32 bit mode. sctp_connectx() will fail with EINVAL.
>
> Kernel issue already fixed in:
>
> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?idÿd5939381c609056b33b7585fb05a77b4c695f3 
>
>
Thanks Daniel,

The patch is small, I can easily apply to my running kernel.

Dong
>> Thanks,
>>
>> Dong