From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:42490 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751625AbeCPNdI (ORCPT ); Fri, 16 Mar 2018 09:33:08 -0400 Subject: Patch "fixup: sctp: verify size of a new chunk in _sctp_make_chunk()" has been added to the 3.18-stable tree To: gregkh@linuxfoundation.org, alexey.kodanev@oracle.com, ben.hutchings@codethink.co.uk, davem@davemloft.net, marcelo.leinter@gmail.com, nhorman@tuxdriver.com Cc: , From: Date: Fri, 16 Mar 2018 14:33:07 +0100 In-Reply-To: <20180313095600.GA5131@kroah.com> Message-ID: <152120718719384@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled fixup: sctp: verify size of a new chunk in _sctp_make_chunk() to the 3.18-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: fixup-sctp-verify-size-of-a-new-chunk-in-_sctp_make_chunk.patch and it can be found in the queue-3.18 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From gregkh@linuxfoundation.org Fri Mar 16 14:27:34 2018 From: Greg Kroah-Hartman Date: Tue, 13 Mar 2018 10:56:00 +0100 Subject: fixup: sctp: verify size of a new chunk in _sctp_make_chunk() To: Ben Hutchings Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org, Alexey Kodanev , Marcelo Ricardo Leitner , Neil Horman , "David S. Miller" Message-ID: <20180313095600.GA5131@kroah.com> Content-Disposition: inline From: Greg Kroah-Hartman Ben writes: > > + int chunklen; > > + > > + chunklen = sizeof(*chunk_hdr) + paylen; > > I think this length still needs to be rounded up (with WORD_ROUND here, > instead of SCTP_PAD4 upstream). So here's a fix for this problem. Reported-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman --- net/sctp/sm_make_chunk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -1369,7 +1369,7 @@ static struct sctp_chunk *_sctp_make_chu struct sock *sk; int chunklen; - chunklen = sizeof(*chunk_hdr) + paylen; + chunklen = WORD_ROUND(sizeof(*chunk_hdr) + paylen); if (chunklen > SCTP_MAX_CHUNK_LEN) goto nodata; Patches currently in stable-queue which might be from gregkh@linuxfoundation.org are queue-3.18/scsi-qla2xxx-fix-null-pointer-crash-due-to-active-timer-for-abts.patch queue-3.18/scripts-recordmcount-break-hardlinks.patch queue-3.18/alsa-seq-don-t-allow-resizing-pool-in-use.patch queue-3.18/serial-sh-sci-prevent-lockup-on-full-tty-buffers.patch queue-3.18/serial-8250_pci-add-brainboxes-uc-260-4-port-serial-device.patch queue-3.18/usb-usbmon-read-text-within-supplied-buffer-size.patch queue-3.18/x86-mce-serialize-sysfs-changes.patch queue-3.18/netfilter-idletimer-be-syzkaller-friendly.patch queue-3.18/usb-quirks-add-control-message-delay-for-1b1c-1b20.patch queue-3.18/x86-module-detect-and-skip-invalid-relocations.patch queue-3.18/ubi-fix-race-condition-between-ubi-volume-creation-and-udev.patch queue-3.18/netfilter-ipv6-fix-use-after-free-write-in-nf_nat_ipv6_manip_pkt.patch queue-3.18/mips-bmips-do-not-mask-ipis-during-suspend.patch queue-3.18/fixup-sctp-verify-size-of-a-new-chunk-in-_sctp_make_chunk.patch queue-3.18/netfilter-ebtables-config_compat-don-t-trust-userland-offsets.patch queue-3.18/alsa-seq-more-protection-for-concurrent-write-and-ioctl-races.patch queue-3.18/x86-treat-r_x86_64_plt32-as-r_x86_64_pc32.patch queue-3.18/usb-usbmon-remove-assignment-from-is_err-argument.patch queue-3.18/uas-fix-comparison-for-error-code.patch queue-3.18/netfilter-bridge-ebt_among-add-missing-match-size-checks.patch queue-3.18/staging-android-ashmem-fix-lockdep-issue-during-llseek.patch queue-3.18/netfilter-nat-cope-with-negative-port-range.patch queue-3.18/netfilter-x_tables-fix-missing-timer-initialization-in-xt_led.patch queue-3.18/tty-serial-atmel-add-new-version-check-for-usart.patch queue-3.18/input-matrix_keypad-fix-race-when-disabling-interrupts.patch