This is a note to let you know that I've just added the patch titled
fixup: sctp: verify size of a new chunk in _sctp_make_chunk()
to the 3.18-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git%3Ba=su...
The filename of the patch is: fixup-sctp-verify-size-of-a-new-chunk-in-_sctp_make_chunk.patch and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let stable@vger.kernel.org know about it.
From gregkh@linuxfoundation.org Fri Mar 16 14:27:34 2018
From: Greg Kroah-Hartman gregkh@linuxfoundation.org Date: Tue, 13 Mar 2018 10:56:00 +0100 Subject: fixup: sctp: verify size of a new chunk in _sctp_make_chunk() To: Ben Hutchings ben.hutchings@codethink.co.uk Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org, Alexey Kodanev alexey.kodanev@oracle.com, Marcelo Ricardo Leitner marcelo.leinter@gmail.com, Neil Horman nhorman@tuxdriver.com, "David S. Miller" davem@davemloft.net Message-ID: 20180313095600.GA5131@kroah.com Content-Disposition: inline
From: Greg Kroah-Hartman gregkh@linuxfoundation.org
Ben writes:
- int chunklen;
- chunklen = sizeof(*chunk_hdr) + paylen;
I think this length still needs to be rounded up (with WORD_ROUND here, instead of SCTP_PAD4 upstream).
So here's a fix for this problem.
Reported-by: Ben Hutchings ben.hutchings@codethink.co.uk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- net/sctp/sm_make_chunk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -1369,7 +1369,7 @@ static struct sctp_chunk *_sctp_make_chu struct sock *sk; int chunklen;
- chunklen = sizeof(*chunk_hdr) + paylen; + chunklen = WORD_ROUND(sizeof(*chunk_hdr) + paylen); if (chunklen > SCTP_MAX_CHUNK_LEN) goto nodata;
Patches currently in stable-queue which might be from gregkh@linuxfoundation.org are
queue-3.18/scsi-qla2xxx-fix-null-pointer-crash-due-to-active-timer-for-abts.patch queue-3.18/scripts-recordmcount-break-hardlinks.patch queue-3.18/alsa-seq-don-t-allow-resizing-pool-in-use.patch queue-3.18/serial-sh-sci-prevent-lockup-on-full-tty-buffers.patch queue-3.18/serial-8250_pci-add-brainboxes-uc-260-4-port-serial-device.patch queue-3.18/usb-usbmon-read-text-within-supplied-buffer-size.patch queue-3.18/x86-mce-serialize-sysfs-changes.patch queue-3.18/netfilter-idletimer-be-syzkaller-friendly.patch queue-3.18/usb-quirks-add-control-message-delay-for-1b1c-1b20.patch queue-3.18/x86-module-detect-and-skip-invalid-relocations.patch queue-3.18/ubi-fix-race-condition-between-ubi-volume-creation-and-udev.patch queue-3.18/netfilter-ipv6-fix-use-after-free-write-in-nf_nat_ipv6_manip_pkt.patch queue-3.18/mips-bmips-do-not-mask-ipis-during-suspend.patch queue-3.18/fixup-sctp-verify-size-of-a-new-chunk-in-_sctp_make_chunk.patch queue-3.18/netfilter-ebtables-config_compat-don-t-trust-userland-offsets.patch queue-3.18/alsa-seq-more-protection-for-concurrent-write-and-ioctl-races.patch queue-3.18/x86-treat-r_x86_64_plt32-as-r_x86_64_pc32.patch queue-3.18/usb-usbmon-remove-assignment-from-is_err-argument.patch queue-3.18/uas-fix-comparison-for-error-code.patch queue-3.18/netfilter-bridge-ebt_among-add-missing-match-size-checks.patch queue-3.18/staging-android-ashmem-fix-lockdep-issue-during-llseek.patch queue-3.18/netfilter-nat-cope-with-negative-port-range.patch queue-3.18/netfilter-x_tables-fix-missing-timer-initialization-in-xt_led.patch queue-3.18/tty-serial-atmel-add-new-version-check-for-usart.patch queue-3.18/input-matrix_keypad-fix-race-when-disabling-interrupts.patch