diff options
| author | Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> | 2016-10-25 14:27:39 -0200 |
|---|---|---|
| committer | Mister Oyster <oysterized@gmail.com> | 2017-04-11 10:58:44 +0200 |
| commit | 2cab8a3ef0d1c2f936c8dc29b7847b7c5514ddce (patch) | |
| tree | acc9073a3258a785405b7692383ef093073d4386 /net/core/dev.c | |
| parent | 6a2a546a95c0b1236e6858a79a0c4697272f3d1d (diff) | |
sctp: validate chunk len before actually using it
commit bf911e985d6bbaa328c20c3e05f4eb03de11fdd6 upstream.
Andrey Konovalov reported that KASAN detected that SCTP was using a slab
beyond the boundaries. It was caused because when handling out of the
blue packets in function sctp_sf_ootb() it was checking the chunk len
only after already processing the first chunk, validating only for the
2nd and subsequent ones.
The fix is to just move the check upwards so it's also validated for the
1st chunk.
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Diffstat (limited to 'net/core/dev.c')
0 files changed, 0 insertions, 0 deletions