Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c7a03eba authored by Marcelo Ricardo Leitner's avatar Marcelo Ricardo Leitner Committed by Greg Kroah-Hartman
Browse files

sctp: validate from_addr_param return 



[ Upstream commit 0c5dc070ff3d6246d22ddd931f23a6266249e3db ]

Ilja reported that, simply putting it, nothing was validating that
from_addr_param functions were operating on initialized memory. That is,
the parameter itself was being validated by sctp_walk_params, but it
doesn't check for types and their specific sizes and it could be a 0-length
one, causing from_addr_param to potentially work over the next parameter or
even uninitialized memory.

The fix here is to, in all calls to from_addr_param, check if enough space
is there for the wanted IP address type.

Reported-by: default avatarIlja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 012a3944

include/net/sctp/structs.h

+1 −1
Original line number Diff line number Diff line
@@ -474,7 +474,7 @@ struct sctp_af { 
					 int saddr);

	void		(*from_sk)	(union sctp_addr *,

					 struct sock *sk);

	void		(*from_addr_param) (union sctp_addr *,

	bool		(*from_addr_param) (union sctp_addr *,

					    union sctp_addr_param *,

					    __be16 port, int iif);

	int		(*to_addr_param) (const union sctp_addr *,

net/sctp/bind_addr.c

+11 −8
Original line number Diff line number Diff line
@@ -285,22 +285,19 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list, 
		rawaddr = (union sctp_addr_param *)raw_addr_list;



		af = sctp_get_af_specific(param_type2af(param->type));

		if (unlikely(!af)) {

		if (unlikely(!af) ||

		    !af->from_addr_param(&addr, rawaddr, htons(port), 0)) {

			retval = -EINVAL;

			sctp_bind_addr_clean(bp);

			break;

			goto out_err;

		}



		af->from_addr_param(&addr, rawaddr, htons(port), 0);

		if (sctp_bind_addr_state(bp, &addr) != -1)

			goto next;

		retval = sctp_add_bind_addr(bp, &addr, sizeof(addr),

					    SCTP_ADDR_SRC, gfp);

		if (retval) {

		if (retval)

			/* Can't finish building the list, clean up. */

			sctp_bind_addr_clean(bp);

			break;

		}

			goto out_err;



next:

		len = ntohs(param->length);
@@ -309,6 +306,12 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list, 
	}



	return retval;



out_err:

	if (retval)

		sctp_bind_addr_clean(bp);



	return retval;

}



/********************************************************************

net/sctp/input.c

+4 −2
Original line number Diff line number Diff line
@@ -1088,7 +1088,8 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct net *net, 
		if (!af)

			continue;



		af->from_addr_param(paddr, params.addr, sh->source, 0);

		if (!af->from_addr_param(paddr, params.addr, sh->source, 0))

			continue;



		asoc = __sctp_lookup_association(net, laddr, paddr, transportp);

		if (asoc)
@@ -1131,7 +1132,8 @@ static struct sctp_association *__sctp_rcv_asconf_lookup( 
	if (unlikely(!af))

		return NULL;



	af->from_addr_param(&paddr, param, peer_port, 0);

	if (af->from_addr_param(&paddr, param, peer_port, 0))

		return NULL;



	return __sctp_lookup_association(net, laddr, &paddr, transportp);

}

net/sctp/ipv6.c

+6 −1
Original line number Diff line number Diff line
@@ -542,15 +542,20 @@ static void sctp_v6_to_sk_daddr(union sctp_addr *addr, struct sock *sk) 
}



/* Initialize a sctp_addr from an address parameter. */

static void sctp_v6_from_addr_param(union sctp_addr *addr,

static bool sctp_v6_from_addr_param(union sctp_addr *addr,

				    union sctp_addr_param *param,

				    __be16 port, int iif)

{

	if (ntohs(param->v6.param_hdr.length) < sizeof(struct sctp_ipv6addr_param))

		return false;



	addr->v6.sin6_family = AF_INET6;

	addr->v6.sin6_port = port;

	addr->v6.sin6_flowinfo = 0; /* BUG */

	addr->v6.sin6_addr = param->v6.addr;

	addr->v6.sin6_scope_id = iif;



	return true;

}



/* Initialize an address parameter from a sctp_addr and return the length

net/sctp/protocol.c

+6 −1
Original line number Diff line number Diff line
@@ -268,14 +268,19 @@ static void sctp_v4_to_sk_daddr(union sctp_addr *addr, struct sock *sk) 
}



/* Initialize a sctp_addr from an address parameter. */

static void sctp_v4_from_addr_param(union sctp_addr *addr,

static bool sctp_v4_from_addr_param(union sctp_addr *addr,

				    union sctp_addr_param *param,

				    __be16 port, int iif)

{

	if (ntohs(param->v4.param_hdr.length) < sizeof(struct sctp_ipv4addr_param))

		return false;



	addr->v4.sin_family = AF_INET;

	addr->v4.sin_port = port;

	addr->v4.sin_addr.s_addr = param->v4.addr.s_addr;

	memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero));



	return true;

}



/* Initialize an address parameter from a sctp_addr and return the length