sctp: validate chunk len before actually using it
[ Upstream commit bf911e985d6bbaa328c20c3e05f4eb03de11fdd6 ] Andrey Konovalov reported that KASAN detected that SCTP was using a slab beyond the boundaries. It was caused because when handling out of the blue packets in function sctp_sf_ootb() it was checking the chunk len only after already processing the first chunk, validating only for the 2nd and subsequent ones. The fix is to just move the check upwards so it's also validated for the 1st chunk. Change-Id: Ib3ab22816c2aa3dc325686fd5dc8ee93d22e5852 Git-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git Reported-by:Andrey Konovalov <andreyknvl@google.com> Tested-by:
Andrey Konovalov <andreyknvl@google.com> Signed-off-by:
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by:
Akshaya <akshayab@codeaurora.org>
Loading
Please register or sign in to comment