Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1668445
| From | "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH for v4.9 LTS 35/86] net: sctp: fix array overrun read on sctp_timer_tbl |
| Date | 2017-06-18 00:40 +0200 |
| Message-ID | <tTuxQ-5dy-29@gated-at.bofh.it> (permalink) |
| References | <tTuo9-58F-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
From: Colin Ian King <colin.king@canonical.com>
[ Upstream commit 0e73fc9a56f22f2eec4d2b2910c649f7af67b74d ]
The comparison on the timeout can lead to an array overrun
read on sctp_timer_tbl because of an off-by-one error. Fix
this by using < instead of <= and also compare to the array
size rather than SCTP_EVENT_TIMEOUT_MAX.
Fixes CoverityScan CID#1397639 ("Out-of-bounds read")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
net/sctp/debug.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sctp/debug.c b/net/sctp/debug.c
index 95d7b15dad21..e371a0d90068 100644
--- a/net/sctp/debug.c
+++ b/net/sctp/debug.c
@@ -166,7 +166,7 @@ static const char *const sctp_timer_tbl[] = {
/* Lookup timer debug name. */
const char *sctp_tname(const sctp_subtype_t id)
{
- if (id.timeout <= SCTP_EVENT_TIMEOUT_MAX)
+ if (id.timeout < ARRAY_SIZE(sctp_timer_tbl))
return sctp_timer_tbl[id.timeout];
return "unknown_timer";
}
--
2.11.0
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH for v4.9 LTS 01/86] sparc64: Handle PIO & MEM non-resumable errors. "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 80/86] be2net: don't delete MAC on close on unprivileged BE3 VFs "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 81/86] be2net: fix MAC addr setting on privileged BE3 VFs "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 85/86] perf probe: Fix to probe on gcc generated functions in modules "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 03/86] net: ethtool: add support for 2500BaseT and 5000BaseT link modes "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 59/86] usb: gadget: composite: Fix function used to free memory "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 79/86] be2net: fix status check in be_cmd_pmac_add() "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 50/86] Documentation: devicetree: change the mediatek ethernet compatible string "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 82/86] perf probe: Fix to show correct locations for events on modules "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 84/86] tipc: allocate user memory with GFP_KERNEL flag "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 22/86] net: phy: dp83848: add DP83620 PHY support "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 10/86] ARM64: dts: meson-gx: Add firmware reserved memory zones "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 60/86] usb: dwc3: exynos fix axius clock error path to do cleanup "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 20/86] drm/amdgpu: fix program vce instance logic error. "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 76/86] swiotlb: ensure that page-sized mappings are page-aligned "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 32/86] Btrfs: fix truncate down when no_holes feature is enabled "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 83/86] net: phy: dp83867: allow RGMII_TXID/RGMII_RXID interface types "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 54/86] net: phy: marvell: fix Marvell 88E1512 used in SGMII mode "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 52/86] perf/x86/intel/uncore: Fix hardcoded socket 0 assumption in the Haswell init code "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 65/86] drm/amd/powerplay: fix vce cg logic error on CZ/St. "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:30 +0200
[PATCH for v4.9 LTS 43/86] vfio/spapr: fail tce_iommu_attach_group() when iommu_data is null "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 33/86] virtio_console: fix a crash in config_work_handler "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 55/86] mac80211: recalculate min channel width on VHT opmode changes "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 49/86] kernel/panic.c: add missing \n "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 74/86] aio: fix lock dep warning "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 47/86] vxlan: do not age static remote mac entries "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 36/86] xen-netfront: Fix Rx stall during network stress and OOM "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 40/86] amd-xgbe: Check xgbe_init() return code "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 29/86] objtool: Fix IRET's opcode "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 67/86] pmem: return EIO on read_pmem() failure "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 56/86] perf/x86/intel: Use ULL constant to prevent undefined shift behaviour "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 30/86] gianfar: Do not reuse pages from emergency reserve "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 21/86] drm/amdgpu: add support for new hainan variants "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 35/86] net: sctp: fix array overrun read on sctp_timer_tbl "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 57/86] HID: i2c-hid: Add sleep between POWER ON and RESET "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 46/86] ip6_tunnel: must reload ipv6h in ip6ip6_tnl_xmit() "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 78/86] usb: dwc2: gadget: Fix GUSBCFG.USBTRDTIM value "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 53/86] pinctrl: intel: Set pin direction properly "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 86/86] net/mlx4_core: Eliminate warning messages for SRQ_LIMIT under SRIOV "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 42/86] drm/amdgpu: check ring being ready before using "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 70/86] x86/tsc: Add the Intel Denverton Processor to native_calibrate_tsc() "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 37/86] scsi: virtio_scsi: Reject commands when virtqueue is broken "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 64/86] drm/radeon/si: load special ucode for certain MC configs "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 58/86] scsi: lpfc: avoid double free of resource identifiers "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 51/86] drm/etnaviv: trick drm_mm into giving out a low IOVA "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 62/86] arm64: assembler: make adr_l work in modules under KASLR "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 69/86] KVM: arm64: Access CNTHCTL_EL2 bit fields correctly on VHE systems "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 41/86] net: dsa: Check return value of phy_connect_direct() "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 63/86] net: thunderx: acpi: fix LMAC initialization "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 75/86] coredump: Ensure proper size of sparse core files "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 71/86] x86/mpx: Use compatible types in comparison to fix sparse error "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 44/86] mlxsw: spectrum_router: Correctly reallocate adjacency entries "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 45/86] virtio_net: fix PAGE_SIZE > 64k "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 38/86] iwlwifi: fix kernel crash when unregistering thermal zone "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 34/86] swiotlb-xen: update dev_addr after swapping pages "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 68/86] mac80211: initialize SMPS field in HT capabilities "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:40 +0200
[PATCH for v4.9 LTS 14/86] KVM: x86: fix fixing of hypercalls "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
[PATCH for v4.9 LTS 24/86] net: ethtool: Initialize buffer when querying device channel settings "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
[PATCH for v4.9 LTS 23/86] powerpc/eeh: Enable IO path on permanent error "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
[PATCH for v4.9 LTS 26/86] xen-netback: protect resource cleaning on XenBus disconnect "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
[PATCH for v4.9 LTS 07/86] net: phy: use boolean dt properties for eee broken modes "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
[PATCH for v4.9 LTS 04/86] net: phy: add an option to disable EEE advertisement "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
[PATCH for v4.9 LTS 08/86] dt: bindings: net: use boolean dt properties for eee broken modes "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
[PATCH for v4.9 LTS 13/86] ubifs: allow encryption ioctls in compat mode "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
Re: [PATCH for v4.9 LTS 13/86] ubifs: allow encryption ioctls in compat mode Eric Biggers <ebiggers@google.com> - 2017-06-19 19:10 +0200
Re: [PATCH for v4.9 LTS 13/86] ubifs: allow encryption ioctls in compat mode Richard Weinberger <richard@nod.at> - 2017-06-19 21:30 +0200
Re: [PATCH for v4.9 LTS 13/86] ubifs: allow encryption ioctls in compat mode "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-19 21:50 +0200
Re: [PATCH for v4.9 LTS 13/86] ubifs: allow encryption ioctls in compat mode Richard Weinberger <richard@nod.at> - 2017-06-19 22:10 +0200
[PATCH for v4.9 LTS 25/86] xen-netback: fix memory leaks on XenBus disconnect "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
[PATCH for v4.9 LTS 11/86] ARM64: dts: meson-gxbb-odroidc2: fix GbE tx link breakage "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
[PATCH for v4.9 LTS 27/86] bnxt_en: Fix "uninitialized variable" bug in TPA code path. "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
[PATCH for v4.9 LTS 02/86] sparc64: Zero pages on allocation for mondo and error queues. "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
[PATCH for v4.9 LTS 31/86] Btrfs: Fix deadlock between direct IO and fast fsync "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
[PATCH for v4.9 LTS 19/86] qla2xxx: Fix erroneous invalid handle message "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
[PATCH for v4.9 LTS 06/86] net: phy: fix sign type error in genphy_config_eee_advert "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
[PATCH for v4.9 LTS 15/86] scsi: sd: Fix wrong DPOFUA disable in sd_read_cache_type "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
[PATCH for v4.9 LTS 16/86] stmmac: add missing of_node_put "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
[PATCH for v4.9 LTS 05/86] dt-bindings: net: add EEE capability constants "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
[PATCH for v4.9 LTS 18/86] qla2xxx: Terminate exchange if corrupted "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
[PATCH for v4.9 LTS 12/86] perf/x86/intel: Handle exclusive threadid correctly on CPU hotplug "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
[PATCH for v4.9 LTS 28/86] bpf: don't trigger OOM killer under pressure with map alloc "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-06-18 00:50 +0200
csiph-web