From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:50488 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752645AbdHHX33 (ORCPT ); Tue, 8 Aug 2017 19:29:29 -0400 Subject: Patch "sctp: fix an array overflow when all ext chunks are set" has been added to the 4.12-stable tree To: lucien.xin@gmail.com, davem@davemloft.net, gregkh@linuxfoundation.org Cc: , From: Date: Tue, 08 Aug 2017 16:29:23 -0700 Message-ID: <150223496389127@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled sctp: fix an array overflow when all ext chunks are set to the 4.12-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: sctp-fix-an-array-overflow-when-all-ext-chunks-are-set.patch and it can be found in the queue-4.12 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Tue Aug 8 16:27:29 PDT 2017 From: Xin Long Date: Fri, 14 Jul 2017 22:07:33 +0800 Subject: sctp: fix an array overflow when all ext chunks are set From: Xin Long [ Upstream commit 10b3bf54406bb7f4e78da9bb2a485c5c986678ad ] Marcelo noticed an array overflow caused by commit c28445c3cb07 ("sctp: add reconf_enable in asoc ep and netns"), in which sctp would add SCTP_CID_RECONF into extensions when reconf_enable is set in sctp_make_init and sctp_make_init_ack. Then now when all ext chunks are set, 4 ext chunk ids can be put into extensions array while extensions array size is 3. It would cause a kernel panic because of this overflow. This patch is to fix it by defining extensions array size is 4 in both sctp_make_init and sctp_make_init_ack. Fixes: c28445c3cb07 ("sctp: add reconf_enable in asoc ep and netns") Signed-off-by: Xin Long Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/sctp/sm_make_chunk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -228,7 +228,7 @@ struct sctp_chunk *sctp_make_init(const sctp_adaptation_ind_param_t aiparam; sctp_supported_ext_param_t ext_param; int num_ext = 0; - __u8 extensions[3]; + __u8 extensions[4]; sctp_paramhdr_t *auth_chunks = NULL, *auth_hmacs = NULL; @@ -396,7 +396,7 @@ struct sctp_chunk *sctp_make_init_ack(co sctp_adaptation_ind_param_t aiparam; sctp_supported_ext_param_t ext_param; int num_ext = 0; - __u8 extensions[3]; + __u8 extensions[4]; sctp_paramhdr_t *auth_chunks = NULL, *auth_hmacs = NULL, *auth_random = NULL; Patches currently in stable-queue which might be from lucien.xin@gmail.com are queue-4.12/sctp-fix-the-check-for-_sctp_walk_params-and-_sctp_walk_errors.patch queue-4.12/dccp-fix-a-memleak-that-dccp_ipv6-doesn-t-put-reqsk-properly.patch queue-4.12/dccp-fix-a-memleak-that-dccp_ipv4-doesn-t-put-reqsk-properly.patch queue-4.12/dccp-fix-a-memleak-for-dccp_feat_init-err-process.patch queue-4.12/sctp-fix-an-array-overflow-when-all-ext-chunks-are-set.patch