diff options
| author | Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> | 2021-06-28 16:13:41 -0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-07-20 16:16:03 +0200 |
| commit | c7a03ebace4f9cd40d9cd9dd5fb2af558025583c (patch) | |
| tree | 7d272fb87b635abb9c261ef865b7a807b15b42a4 /include | |
| parent | 012a3944008fc774b1eae42be7e8dfc4ee2ab521 (diff) | |
| download | linux-c7a03ebace4f9cd40d9cd9dd5fb2af558025583c.tar.gz linux-c7a03ebace4f9cd40d9cd9dd5fb2af558025583c.tar.bz2 linux-c7a03ebace4f9cd40d9cd9dd5fb2af558025583c.zip | |
sctp: validate from_addr_param return
[ Upstream commit 0c5dc070ff3d6246d22ddd931f23a6266249e3db ]
Ilja reported that, simply putting it, nothing was validating that
from_addr_param functions were operating on initialized memory. That is,
the parameter itself was being validated by sctp_walk_params, but it
doesn't check for types and their specific sizes and it could be a 0-length
one, causing from_addr_param to potentially work over the next parameter or
even uninitialized memory.
The fix here is to, in all calls to from_addr_param, check if enough space
is there for the wanted IP address type.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/net/sctp/structs.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h index 19f8d5881b08..2882bc7a5b4b 100644 --- a/include/net/sctp/structs.h +++ b/include/net/sctp/structs.h @@ -474,7 +474,7 @@ struct sctp_af { int saddr); void (*from_sk) (union sctp_addr *, struct sock *sk); - void (*from_addr_param) (union sctp_addr *, + bool (*from_addr_param) (union sctp_addr *, union sctp_addr_param *, __be16 port, int iif); int (*to_addr_param) (const union sctp_addr *, |