iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net/sctp
History
Xin Long f7e745f8e9 sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb 
We should always check if skb_header_pointer's return is NULL before
using it, otherwise it may cause null-ptr-deref, as syzbot reported:

  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
  RIP: 0010:sctp_rcv_ootb net/sctp/input.c:705 [inline]
  RIP: 0010:sctp_rcv+0x1d84/0x3220 net/sctp/input.c:196
  Call Trace:
  <IRQ>
   sctp6_rcv+0x38/0x60 net/sctp/ipv6.c:1109
   ip6_protocol_deliver_rcu+0x2e9/0x1ca0 net/ipv6/ip6_input.c:422
   ip6_input_finish+0x62/0x170 net/ipv6/ip6_input.c:463
   NF_HOOK include/linux/netfilter.h:307 [inline]
   NF_HOOK include/linux/netfilter.h:301 [inline]
   ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:472
   dst_input include/net/dst.h:460 [inline]
   ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline]
   NF_HOOK include/linux/netfilter.h:307 [inline]
   NF_HOOK include/linux/netfilter.h:301 [inline]
   ipv6_rcv+0x28c/0x3c0 net/ipv6/ip6_input.c:297

Fixes: 3acb50c18d8d ("sctp: delay as much as possible skb_linearize")
Reported-by: syzbot+581aff2ae6b860625116@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-09-24 10:36:19 +01:00
..
associola.c
sctp: enable PLPMTUD when the transport is ready
2021-06-22 11:28:52 -07:00
auth.c
sctp: move the active_key update after sh_keys is added
2021-08-03 11:43:43 +01:00
bind_addr.c
sctp: validate from_addr_param return
2021-06-28 15:34:50 -07:00
chunk.c
net: sctp: chunk.c: delete duplicated word
2020-08-24 16:21:43 -07:00
debug.c
sctp: add the probe timer in transport for PLPMTUD
2021-06-22 11:28:52 -07:00
diag.c
net: Use nlmsg_unicast() instead of netlink_unicast()
2021-07-13 09:28:29 -07:00
endpointola.c
sctp: get netns from asoc and ep base
2019-12-09 20:14:01 -08:00
input.c
sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb
2021-09-24 10:36:19 +01:00
inqueue.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 104
2019-05-24 17:39:00 +02:00
ipv6.c
sctp: delete addr based on sin6_scope_id
2021-07-26 12:34:03 +01:00
Kconfig
sctp: create udp4 sock and add its encap_rcv
2020-10-30 15:23:52 -07:00
Makefile
sctp: rename sctp_diag.c as diag.c
2018-02-13 13:56:31 -05:00
objcnt.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 104
2019-05-24 17:39:00 +02:00
offload.c
sctp: remove the NETIF_F_SG flag before calling skb_segment
2021-01-16 19:05:59 -08:00
output.c
sctp: do not update transport pathmtu if SPP_PMTUD_ENABLE is not set
2021-07-21 14:17:58 -07:00
outqueue.c
sctp: do the basic send and recv for PLPMTUD probe
2021-06-22 11:28:52 -07:00
primitive.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 104
2019-05-24 17:39:00 +02:00
proc.c
net: fix iteration for sctp transport seq_files
2021-02-08 10:15:49 -08:00
protocol.c
sctp: move 198 addresses from unusable to private scope
2021-07-01 11:47:13 -07:00
sm_make_chunk.c
sctp: prevent info leak in sctp_make_heartbeat()
2021-07-01 11:16:38 -07:00
sm_sideeffect.c
sctp: add the probe timer in transport for PLPMTUD
2021-06-22 11:28:52 -07:00
sm_statefuns.c
sctp: improve the code for pmtu probe send and recv update
2021-07-25 23:06:02 +01:00
sm_statetable.c
sctp: add the probe timer in transport for PLPMTUD
2021-06-22 11:28:52 -07:00
socket.c
sctp: trim optlen when it's a huge value in sctp_setsockopt
2021-07-18 09:47:29 -07:00
stream_interleave.c
sctp: get netns from asoc and ep base
2019-12-09 20:14:01 -08:00
stream_sched_prio.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 104
2019-05-24 17:39:00 +02:00
stream_sched_rr.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 104
2019-05-24 17:39:00 +02:00
stream_sched.c
sctp: rename asoc intl_enable to asoc peer.intl_capable
2019-07-08 20:16:25 -07:00
stream.c
net: sctp: Fix negotiation of the number of data streams.
2020-08-20 16:37:37 -07:00
sysctl.c
sctp: add probe_interval in sysctl and sock/asoc/transport
2021-06-22 11:28:51 -07:00
transport.c
sctp: send pmtu probe only if packet loss in Search Complete state
2021-07-25 23:06:02 +01:00
tsnmap.c
net: sctp: trivial: fix typo in comment
2021-03-04 13:48:32 -08:00
ulpevent.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-05-31 17:48:46 -07:00
ulpqueue.c
net: sctp: ulpqueue.c: delete duplicated word
2020-08-24 16:21:43 -07:00