From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: [PATCH net] sctp: make sure stream nums can match optlen in sctp_setsockopt_reset_streams Date: Mon, 11 Dec 2017 14:09:05 -0500 (EST) Message-ID: <20171211.140905.1841726891785938849.davem@davemloft.net> References: Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org, linux-sctp@vger.kernel.org, marcelo.leitner@gmail.com, nhorman@tuxdriver.com, syzkaller@googlegroups.com To: lucien.xin@gmail.com Return-path: Received: from shards.monkeyblade.net ([184.105.139.130]:38636 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751347AbdLKTJH (ORCPT ); Mon, 11 Dec 2017 14:09:07 -0500 In-Reply-To: Sender: netdev-owner@vger.kernel.org List-ID: From: Xin Long Date: Sun, 10 Dec 2017 15:40:51 +0800 > Now in sctp_setsockopt_reset_streams, it only does the check > optlen < sizeof(*params) for optlen. But it's not enough, as > params->srs_number_streams should also match optlen. > > If the streams in params->srs_stream_list are less than stream > nums in params->srs_number_streams, later when dereferencing > the stream list, it could cause a slab-out-of-bounds crash, as > reported by syzbot. > > This patch is to fix it by also checking the stream numbers in > sctp_setsockopt_reset_streams to make sure at least it's not > greater than the streams in the list. > > Fixes: 7f9d68ac944e ("sctp: implement sender-side procedures for SSN Reset Request Parameter") > Reported-by: Dmitry Vyukov > Signed-off-by: Xin Long Applied and queued up for -stable, thanks.