Commit f9beb95e authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'sctp-size-validations' 



Marcelo Ricardo Leitner says:

====================
sctp: add some size validations

Ilja Van Sprundel reported that some size validations on inbound
SCTP packets were missing. After some code review, I noticed two
others that are all fixed here.

Thanks Ilja for reporting this.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 9ea3e52c ef6c8d6c

include/net/sctp/structs.h

+1 −1
Original line number Diff line number Diff line
@@ -461,7 +461,7 @@ struct sctp_af { 
					 int saddr);

	void		(*from_sk)	(union sctp_addr *,

					 struct sock *sk);

	void		(*from_addr_param) (union sctp_addr *,

	bool		(*from_addr_param) (union sctp_addr *,

					    union sctp_addr_param *,

					    __be16 port, int iif);

	int		(*to_addr_param) (const union sctp_addr *,

net/sctp/bind_addr.c

+11 −8
Original line number Diff line number Diff line
@@ -270,22 +270,19 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list, 
		rawaddr = (union sctp_addr_param *)raw_addr_list;



		af = sctp_get_af_specific(param_type2af(param->type));

		if (unlikely(!af)) {

		if (unlikely(!af) ||

		    !af->from_addr_param(&addr, rawaddr, htons(port), 0)) {

			retval = -EINVAL;

			sctp_bind_addr_clean(bp);

			break;

			goto out_err;

		}



		af->from_addr_param(&addr, rawaddr, htons(port), 0);

		if (sctp_bind_addr_state(bp, &addr) != -1)

			goto next;

		retval = sctp_add_bind_addr(bp, &addr, sizeof(addr),

					    SCTP_ADDR_SRC, gfp);

		if (retval) {

		if (retval)

			/* Can't finish building the list, clean up. */

			sctp_bind_addr_clean(bp);

			break;

		}

			goto out_err;



next:

		len = ntohs(param->length);
@@ -294,6 +291,12 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list, 
	}



	return retval;



out_err:

	if (retval)

		sctp_bind_addr_clean(bp);



	return retval;

}



/********************************************************************

net/sctp/input.c

+8 −3
Original line number Diff line number Diff line
@@ -1131,7 +1131,8 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct net *net, 
		if (!af)

			continue;



		af->from_addr_param(paddr, params.addr, sh->source, 0);

		if (!af->from_addr_param(paddr, params.addr, sh->source, 0))

			continue;



		asoc = __sctp_lookup_association(net, laddr, paddr, transportp);

		if (asoc)
@@ -1167,6 +1168,9 @@ static struct sctp_association *__sctp_rcv_asconf_lookup( 
	union sctp_addr_param *param;

	union sctp_addr paddr;



	if (ntohs(ch->length) < sizeof(*asconf) + sizeof(struct sctp_paramhdr))

		return NULL;



	/* Skip over the ADDIP header and find the Address parameter */

	param = (union sctp_addr_param *)(asconf + 1);
@@ -1174,7 +1178,8 @@ static struct sctp_association *__sctp_rcv_asconf_lookup( 
	if (unlikely(!af))

		return NULL;



	af->from_addr_param(&paddr, param, peer_port, 0);

	if (af->from_addr_param(&paddr, param, peer_port, 0))

		return NULL;



	return __sctp_lookup_association(net, laddr, &paddr, transportp);

}
@@ -1245,7 +1250,7 @@ static struct sctp_association *__sctp_rcv_walk_lookup(struct net *net, 


		ch = (struct sctp_chunkhdr *)ch_end;

		chunk_num++;

	} while (ch_end < skb_tail_pointer(skb));

	} while (ch_end + sizeof(*ch) < skb_tail_pointer(skb));



	return asoc;

}

net/sctp/ipv6.c

+6 −1
Original line number Diff line number Diff line
@@ -551,15 +551,20 @@ static void sctp_v6_to_sk_daddr(union sctp_addr *addr, struct sock *sk) 
}



/* Initialize a sctp_addr from an address parameter. */

static void sctp_v6_from_addr_param(union sctp_addr *addr,

static bool sctp_v6_from_addr_param(union sctp_addr *addr,

				    union sctp_addr_param *param,

				    __be16 port, int iif)

{

	if (ntohs(param->v6.param_hdr.length) < sizeof(struct sctp_ipv6addr_param))

		return false;



	addr->v6.sin6_family = AF_INET6;

	addr->v6.sin6_port = port;

	addr->v6.sin6_flowinfo = 0; /* BUG */

	addr->v6.sin6_addr = param->v6.addr;

	addr->v6.sin6_scope_id = iif;



	return true;

}



/* Initialize an address parameter from a sctp_addr and return the length

net/sctp/protocol.c

+6 −1
Original line number Diff line number Diff line
@@ -254,14 +254,19 @@ static void sctp_v4_to_sk_daddr(union sctp_addr *addr, struct sock *sk) 
}



/* Initialize a sctp_addr from an address parameter. */

static void sctp_v4_from_addr_param(union sctp_addr *addr,

static bool sctp_v4_from_addr_param(union sctp_addr *addr,

				    union sctp_addr_param *param,

				    __be16 port, int iif)

{

	if (ntohs(param->v4.param_hdr.length) < sizeof(struct sctp_ipv4addr_param))

		return false;



	addr->v4.sin_family = AF_INET;

	addr->v4.sin_port = port;

	addr->v4.sin_addr.s_addr = param->v4.addr.s_addr;

	memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero));



	return true;

}



/* Initialize an address parameter from a sctp_addr and return the length