Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2b52f2c4 authored by Xin Long's avatar Xin Long Committed by Greg Kroah-Hartman
Browse files

sctp: check policy more carefully when getting pr status 



[ Upstream commit 713358369382cebf92f6e98ce2005f94e7344931 ]

When getting pr_assocstatus and pr_streamstatus by sctp_getsockopt,
it doesn't correctly process the case when policy is set with
SCTP_PR_SCTP_ALL | SCTP_PR_SCTP_MASK. It even causes a
slab-out-of-bounds in sctp_getsockopt_pr_streamstatus().

This patch fixes it by return -EINVAL for this case.

Fixes: 0ac1077e ("sctp: get pr_assoc and pr_stream all status with SCTP_PR_SCTP_ALL")
Reported-by: default avatar <syzbot+5da0d0a72a9e7d791748@syzkaller.appspotmail.com>
Suggested-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7ce2e02c

net/sctp/socket.c

+5 −3
Original line number Diff line number Diff line
@@ -7101,14 +7101,15 @@ static int sctp_getsockopt_pr_assocstatus(struct sock *sk, int len, 
	}



	policy = params.sprstat_policy;

	if (!policy || (policy & ~(SCTP_PR_SCTP_MASK | SCTP_PR_SCTP_ALL)))

	if (!policy || (policy & ~(SCTP_PR_SCTP_MASK | SCTP_PR_SCTP_ALL)) ||

	    ((policy & SCTP_PR_SCTP_ALL) && (policy & SCTP_PR_SCTP_MASK)))

		goto out;



	asoc = sctp_id2assoc(sk, params.sprstat_assoc_id);

	if (!asoc)

		goto out;



	if (policy & SCTP_PR_SCTP_ALL) {

	if (policy == SCTP_PR_SCTP_ALL) {

		params.sprstat_abandoned_unsent = 0;

		params.sprstat_abandoned_sent = 0;

		for (policy = 0; policy <= SCTP_PR_INDEX(MAX); policy++) {
@@ -7160,7 +7161,8 @@ static int sctp_getsockopt_pr_streamstatus(struct sock *sk, int len, 
	}



	policy = params.sprstat_policy;

	if (!policy || (policy & ~(SCTP_PR_SCTP_MASK | SCTP_PR_SCTP_ALL)))

	if (!policy || (policy & ~(SCTP_PR_SCTP_MASK | SCTP_PR_SCTP_ALL)) ||

	    ((policy & SCTP_PR_SCTP_ALL) && (policy & SCTP_PR_SCTP_MASK)))

		goto out;



	asoc = sctp_id2assoc(sk, params.sprstat_assoc_id);