Commit 6d232f6c authored Dec 19, 2024 by Nikolay Kuratov Committed by Wen Zhiwei Mar 11, 2025

net/sctp: Prevent autoclose integer overflow in sctp_association_init()

stable inclusion
from stable-v6.6.70
commit 271f031f4c31c07e2a85a1ba2b4c8e734909a477
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IBOHV1

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=271f031f4c31c07e2a85a1ba2b4c8e734909a477



--------------------------------

commit 4e86729d1ff329815a6e8a920cb554a1d4cb5b8d upstream.

While by default max_autoclose equals to INT_MAX / HZ, one may set
net.sctp.max_autoclose to UINT_MAX. There is code in
sctp_association_init() that can consequently trigger overflow.

Cc: stable@vger.kernel.org
Fixes: 9f70f46b ("sctp: properly latch and use autoclose value from sock to association")
Signed-off-by: Nikolay Kuratov <kniv@yandex-team.ru>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20241219162114.2863827-1-kniv@yandex-team.ru


Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Wen Zhiwei <wenzhiwei@kylinos.cn>

parent c02ee6b5

net/sctp/associola.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -137,7 +137,8 @@ static struct sctp_association *sctp_association_init(
		= 5 * asoc->rto_max;

		asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] = asoc->sackdelay;
		asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] = sp->autoclose * HZ;
		asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] =
		(unsigned long)sp->autoclose * HZ;

		/* Initializes the timers */
		for (i = SCTP_EVENT_TIMEOUT_NONE; i < SCTP_NUM_TIMEOUT_TYPES; ++i)