Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1657724

[PATCH 3.18 16/33] sctp: fix ICMP processing if skb is non-linear

Show all headers | View raw

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Davide Caratti <dcaratti@redhat.com>


[ Upstream commit 804ec7ebe8ea003999ca8d1bfc499edc6a9e07df ]

sometimes ICMP replies to INIT chunks are ignored by the client, even if
the encapsulated SCTP headers match an open socket. This happens when the
ICMP packet is carried by a paged skb: use skb_header_pointer() to read
packet contents beyond the SCTP header, so that chunk header and initiate
tag are validated correctly.

v2:
- don't use skb_header_pointer() to read the transport header, since
  icmp_socket_deliver() already puts these 8 bytes in the linear area.
- change commit message to make specific reference to INIT chunks.

Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/input.c |   16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -472,15 +472,14 @@ struct sock *sctp_err_lookup(struct net
 			     struct sctp_association **app,
 			     struct sctp_transport **tpp)
 {
+	struct sctp_init_chunk *chunkhdr, _chunkhdr;
 	union sctp_addr saddr;
 	union sctp_addr daddr;
 	struct sctp_af *af;
 	struct sock *sk = NULL;
 	struct sctp_association *asoc;
 	struct sctp_transport *transport = NULL;
-	struct sctp_init_chunk *chunkhdr;
 	__u32 vtag = ntohl(sctphdr->vtag);
-	int len = skb->len - ((void *)sctphdr - (void *)skb->data);
 
 	*app = NULL; *tpp = NULL;
 
@@ -515,13 +514,16 @@ struct sock *sctp_err_lookup(struct net
 	 * discard the packet.
 	 */
 	if (vtag == 0) {
-		chunkhdr = (void *)sctphdr + sizeof(struct sctphdr);
-		if (len < sizeof(struct sctphdr) + sizeof(sctp_chunkhdr_t)
-			  + sizeof(__be32) ||
+		/* chunk header + first 4 octects of init header */
+		chunkhdr = skb_header_pointer(skb, skb_transport_offset(skb) +
+					      sizeof(struct sctphdr),
+					      sizeof(struct sctp_chunkhdr) +
+					      sizeof(__be32), &_chunkhdr);
+		if (!chunkhdr ||
 		    chunkhdr->chunk_hdr.type != SCTP_CID_INIT ||
-		    ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag) {
+		    ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag)
 			goto out;
-		}
+
 	} else if (vtag != asoc->c.peer_vtag) {
 		goto out;
 	}

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.18 00/33] 3.18.56-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 18:20 +0200
  [PATCH 3.18 06/33] s390/qeth: avoid null pointer dereference on OSN Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 18:20 +0200
  [PATCH 3.18 23/33] mm/migrate: fix refcount handling when !hugepage_migration_supported() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 18:20 +0200
  [PATCH 3.18 20/33] ALSA: hda - apply STAC_9200_DELL_M22 quirk for Dell Latitude D430 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 18:20 +0200
  [PATCH 3.18 12/33] ipv6: Check ip6_find_1stfragopt() return value properly. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 18:20 +0200
  [PATCH 3.18 16/33] sctp: fix ICMP processing if skb is non-linear Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 18:20 +0200
  [PATCH 3.18 30/33] xfs: fix up quotacheck buffer list error handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 18:20 +0200
  [PATCH 3.18 22/33] drm/gma500/psb: Actually use VBT mode when it is found Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 18:30 +0200
  [PATCH 3.18 33/33] xfs: fix unaligned access in xfs_btree_visit_blocks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:40 +0200
  [PATCH 3.18 08/33] sctp: fix src address selection if using secondary addresses for ipv6 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:40 +0200
  [PATCH 3.18 14/33] ipv6: fix out of bound writes in __ip6_append_data() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:40 +0200
  [PATCH 3.18 29/33] xfs: prevent multi-fsb dir readahead from reading random blocks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:40 +0200
  [PATCH 3.18 32/33] xfs: bad assertion for delalloc an extent that start at i_size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:40 +0200
  [PATCH 3.18 27/33] xfs: fix over-copying of getbmap parameters from userspace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:40 +0200
  [PATCH 3.18 21/33] slub/memcg: cure the brainless abuse of sysfs attributes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:40 +0200
  [PATCH 3.18 31/33] xfs: fix indlen accounting error on partial delalloc conversion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-05 19:40 +0200
  Re: [PATCH 3.18 01/33] Revert "stackprotector: Increase the per-task  stack canarys random range from 32 bits to 64 bits on 64-bit platforms" Kees Cook <keescook@chromium.org> - 2017-06-05 21:20 +0200
    Re: [kernel-hardening] Re: [PATCH 3.18 01/33] Revert  "stackprotector: Increase the per-task stack canarys random range from 32  bits to 64 bits on 64-bit platforms" Eric Biggers <ebiggers3@gmail.com> - 2017-06-05 22:10 +0200
      Re: [kernel-hardening] Re: [PATCH 3.18 01/33] Revert  "stackprotector: Increase the per-task stack canarys random range from 32  bits to 64 bits on 64-bit platforms" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-06 09:30 +0200
  Re: [PATCH 3.18 00/33] 3.18.56-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-06-05 22:40 +0200
  Re: [PATCH 3.18 00/33] 3.18.56-stable review Guenter Roeck <linux@roeck-us.net> - 2017-06-06 00:10 +0200
  Re: [PATCH 3.18 00/33] 3.18.56-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-06 09:30 +0200
    Re: [PATCH 3.18 00/33] 3.18.56-stable review Kevin Hilman <khilman@baylibre.com> - 2017-06-06 23:00 +0200

csiph-web