From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C78A6C433F5 for ; Mon, 1 Nov 2021 09:21:18 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B2B096117A for ; Mon, 1 Nov 2021 09:21:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232336AbhKAJXu (ORCPT ); Mon, 1 Nov 2021 05:23:50 -0400 Received: from mail.kernel.org ([198.145.29.99]:58984 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232259AbhKAJWh (ORCPT ); Mon, 1 Nov 2021 05:22:37 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 364C461100; Mon, 1 Nov 2021 09:19:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1635758378; bh=CUuidrJzzK99RFNt+LiN1DKHXmqe82HmmL1atc91zyM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ovzxobKs5YFqpPTCtQkFvOyJxLeG3wrcf0Z4A/Y06dJETBKgOZFhtdouBQo+I5uQ9 2f5BzTDD7ezuDt2yOC27LtBdyUxot3G/ajK50gVUMEA46Q0r8JyTTNfZ7ws8hEIIZd 4zyeper2F4T0/PxB4I7qcSP/9/FfE0g2WdtPhb7M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xin Long , Marcelo Ricardo Leitner , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.9 19/20] sctp: use init_tag from inithdr for ABORT chunk Date: Mon, 1 Nov 2021 10:17:28 +0100 Message-Id: <20211101082448.197311389@linuxfoundation.org> X-Mailer: git-send-email 2.33.1 In-Reply-To: <20211101082444.133899096@linuxfoundation.org> References: <20211101082444.133899096@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Xin Long [ Upstream commit 4f7019c7eb33967eb87766e0e4602b5576873680 ] Currently Linux SCTP uses the verification tag of the existing SCTP asoc when failing to process and sending the packet with the ABORT chunk. This will result in the peer accepting the ABORT chunk and removing the SCTP asoc. One could exploit this to terminate a SCTP asoc. This patch is to fix it by always using the initiate tag of the received INIT chunk for the ABORT chunk to be sent. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/sctp/sm_statefuns.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index 9045f6bcb34c..c3d293dc8281 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -6018,6 +6018,7 @@ static struct sctp_packet *sctp_ootb_pkt_new(struct net *net, * yet. */ switch (chunk->chunk_hdr->type) { + case SCTP_CID_INIT: case SCTP_CID_INIT_ACK: { sctp_initack_chunk_t *initack; -- 2.33.0