Commit c52b446b authored by Xin Long's avatar Xin Long Committed by Greg Kroah-Hartman

sctp: fix an array overflow when all ext chunks are set


[ Upstream commit 10b3bf54 ]

Marcelo noticed an array overflow caused by commit c28445c3
("sctp: add reconf_enable in asoc ep and netns"), in which sctp
would add SCTP_CID_RECONF into extensions when reconf_enable is
set in sctp_make_init and sctp_make_init_ack.

Then now when all ext chunks are set, 4 ext chunk ids can be put
into extensions array while extensions array size is 3. It would
cause a kernel panic because of this overflow.

This patch is to fix it by defining extensions array size is 4 in
both sctp_make_init and sctp_make_init_ack.

Fixes: c28445c3 ("sctp: add reconf_enable in asoc ep and netns")
Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 52bc1dfd
...@@ -228,7 +228,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc, ...@@ -228,7 +228,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
sctp_adaptation_ind_param_t aiparam; sctp_adaptation_ind_param_t aiparam;
sctp_supported_ext_param_t ext_param; sctp_supported_ext_param_t ext_param;
int num_ext = 0; int num_ext = 0;
__u8 extensions[3]; __u8 extensions[4];
sctp_paramhdr_t *auth_chunks = NULL, sctp_paramhdr_t *auth_chunks = NULL,
*auth_hmacs = NULL; *auth_hmacs = NULL;
...@@ -396,7 +396,7 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc, ...@@ -396,7 +396,7 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
sctp_adaptation_ind_param_t aiparam; sctp_adaptation_ind_param_t aiparam;
sctp_supported_ext_param_t ext_param; sctp_supported_ext_param_t ext_param;
int num_ext = 0; int num_ext = 0;
__u8 extensions[3]; __u8 extensions[4];
sctp_paramhdr_t *auth_chunks = NULL, sctp_paramhdr_t *auth_chunks = NULL,
*auth_hmacs = NULL, *auth_hmacs = NULL,
*auth_random = NULL; *auth_random = NULL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment