Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit afd0a800 authored by Jakub Audykowicz's avatar Jakub Audykowicz Committed by David S. Miller
Browse files

sctp: frag_point sanity check 



If for some reason an association's fragmentation point is zero,
sctp_datamsg_from_user will try to endlessly try to divide a message
into zero-sized chunks. This eventually causes kernel panic due to
running out of memory.

Although this situation is quite unlikely, it has occurred before as
reported. I propose to add this simple last-ditch sanity check due to
the severity of the potential consequences.

Signed-off-by: default avatarJakub Audykowicz <jakub.audykowicz@gmail.com>
Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b2b7af86

include/net/sctp/sctp.h

+5 −0
Original line number Diff line number Diff line
@@ -620,4 +620,9 @@ static inline bool sctp_transport_pmtu_check(struct sctp_transport *t) 
	return false;

}



static inline __u32 sctp_min_frag_point(struct sctp_sock *sp, __u16 datasize)

{

	return sctp_mtu_payload(sp, SCTP_DEFAULT_MINSEGMENT, datasize);

}



#endif /* __net_sctp_h__ */

net/sctp/chunk.c

+6 −0
Original line number Diff line number Diff line
@@ -191,6 +191,12 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc, 
	 * the packet

	 */

	max_data = asoc->frag_point;

	if (unlikely(!max_data)) {

		max_data = sctp_min_frag_point(sctp_sk(asoc->base.sk),

					       sctp_datachk_len(&asoc->stream));

		pr_warn_ratelimited("%s: asoc:%p frag_point is zero, forcing max_data to default minimum (%Zu)",

				    __func__, asoc, max_data);

	}



	/* If the the peer requested that we authenticate DATA chunks

	 * we need to account for bundling of the AUTH chunks along with

net/sctp/socket.c

+1 −2
Original line number Diff line number Diff line
@@ -3324,8 +3324,7 @@ static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned 
		__u16 datasize = asoc ? sctp_datachk_len(&asoc->stream) :

				 sizeof(struct sctp_data_chunk);



		min_len = sctp_mtu_payload(sp, SCTP_DEFAULT_MINSEGMENT,

					   datasize);

		min_len = sctp_min_frag_point(sp, datasize);

		max_len = SCTP_MAX_CHUNK_LEN - datasize;



		if (val < min_len || val > max_len)