sctp: validate chunk len before actually using it
Andrey Konovalov reported that KASAN detected that SCTP was using a slab beyond the boundaries. It was caused because when handling out of the blue packets in function sctp_sf_ootb() it was checking the chunk len only after already processing the first chunk, validating only for the 2nd and subsequent ones. The fix is to just move the check upwards so it's also validated for the 1st chunk. Backport reference: * WORD_ROUND was later replaced with SCTP_PAD4 Change-Id: I1e1c96e088f77231b319b728c8e4c6a6b541c6c0 Reported-by:Andrey Konovalov <andreyknvl@google.com> Tested-by:
Andrey Konovalov <andreyknvl@google.com> Signed-off-by:
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Reviewed-by:
Xin Long <lucien.xin@gmail.com> Acked-by:
Neil Horman <nhorman@tuxdriver.com> Signed-off-by:
David S. Miller <davem@davemloft.net> Signed-off-by:
Adrian DC <radian.dc@gmail.com>
Loading
Please register or sign in to comment