diff options
| author | Stefan Wiehler <stefan.wiehler@nokia.com> | 2025-10-28 17:12:27 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-11-13 15:34:38 -0500 |
| commit | 2fe08fcaacb7eb019fa9c81db39b2214de216677 (patch) | |
| tree | f910abbcd9f7aa12ef5d53c19ce58b8924b30a27 | |
| parent | 97a2bb90a6b64b9693a5e88a69007d0ffbd6accf (diff) | |
| download | linux-2fe08fcaacb7eb019fa9c81db39b2214de216677.tar.gz linux-2fe08fcaacb7eb019fa9c81db39b2214de216677.tar.bz2 linux-2fe08fcaacb7eb019fa9c81db39b2214de216677.zip | |
sctp: Prevent TOCTOU out-of-bounds write
[ Upstream commit 95aef86ab231f047bb8085c70666059b58f53c09 ]
For the following path not holding the sock lock,
sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump()
make sure not to exceed bounds in case the address list has grown
between buffer allocation (time-of-check) and write (time-of-use).
Suggested-by: Kuniyuki Iwashima <kuniyu@google.com>
Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file")
Signed-off-by: Stefan Wiehler <stefan.wiehler@nokia.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20251028161506.3294376-3-stefan.wiehler@nokia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | net/sctp/diag.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/sctp/diag.c b/net/sctp/diag.c index dadf8254b30f..95e65b9d623b 100644 --- a/net/sctp/diag.c +++ b/net/sctp/diag.c @@ -88,6 +88,9 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb, memcpy(info, &laddr->a, sizeof(laddr->a)); memset(info + sizeof(laddr->a), 0, addrlen - sizeof(laddr->a)); info += addrlen; + + if (!--addrcnt) + break; } rcu_read_unlock(); |