From: David Miller <davem@davemloft.net>
To: marcelo.leitner@gmail.com
Cc: netdev@vger.kernel.org, dvyukov@google.com,
nhorman@tuxdriver.com, vyasevich@gmail.com,
linux-sctp@vger.kernel.org, linux-kernel@vger.kernel.org,
syzkaller@googlegroups.com, kcc@google.com, glider@google.com,
sasha.levin@oracle.com, edumazet@google.com, lkp@intel.com,
fengguang.wu@intel.com
Subject: Re: [PATCH net v2] sctp: fix copying more bytes than expected in sctp_add_bind_addr
Date: Tue, 08 Mar 2016 15:05:17 -0500 (EST) [thread overview]
Message-ID: <20160308.150517.1036872213180279520.davem@davemloft.net> (raw)
In-Reply-To: <c774cc7c0b589b8fe979fea7bf1aa6748eecd2f0.1457443254.git.marcelo.leitner@gmail.com>
From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Date: Tue, 8 Mar 2016 10:34:28 -0300
> Dmitry reported that sctp_add_bind_addr may read more bytes than
> expected in case the parameter is a IPv4 addr supplied by the user
> through calls such as sctp_bindx_add(), because it always copies
> sizeof(union sctp_addr) while the buffer may be just a struct
> sockaddr_in, which is smaller.
>
> This patch then fixes it by limiting the memcpy to the min between the
> union size and a (new parameter) provided addr size. Where possible this
> parameter still is the size of that union, except for reading from
> user-provided buffers, which then it accounts for protocol type.
>
> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> Tested-by: Dmitry Vyukov <dvyukov@google.com>
> Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Applied, thanks.
prev parent reply other threads:[~2016-03-08 20:05 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-03-08 13:34 [PATCH net v2] sctp: fix copying more bytes than expected in sctp_add_bind_addr Marcelo Ricardo Leitner
2016-03-08 20:05 ` David Miller [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160308.150517.1036872213180279520.davem@davemloft.net \
--to=davem@davemloft.net \
--cc=dvyukov@google.com \
--cc=edumazet@google.com \
--cc=fengguang.wu@intel.com \
--cc=glider@google.com \
--cc=kcc@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sctp@vger.kernel.org \
--cc=lkp@intel.com \
--cc=marcelo.leitner@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=nhorman@tuxdriver.com \
--cc=sasha.levin@oracle.com \
--cc=syzkaller@googlegroups.com \
--cc=vyasevich@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).