Marcelo Ricardo Leitner
a01745edc1
sctp: add size validation when walking chunks ...
[ Upstream commit 50619dbf8db77e98d821d615af4f634d08e22698 ]
The first chunk in a packet is ensured to be present at the beginning of
sctp_rcv(), as a packet needs to have at least 1 chunk. But the second
one, may not be completely available and ch->length can be over
uninitialized memory.
Fix here is by only trying to walk on the next chunk if there is enough to
hold at least the header, and then proceed with the ch->length validation
that is already there.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-19 08:53:13 +02:00
Bluetooth: Shutdown controller after workqueues are flushed or cancelled
2021-07-19 08:53:13 +02:00
bpfilter: Specify the log level for the kmsg message
2021-07-14 16:53:33 +02:00
net: bridge: fix vlan tunnel dst refcnt when egressing
2021-06-23 14:41:30 +02:00
can: j1939: j1939_sk_init(): set SOCK_RCU_FREE to call sk_destruct() after RCU is done
2021-07-14 16:53:04 +02:00
net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT
2021-07-19 08:53:08 +02:00
net: ip: avoid OOM kills with large UDP sends over loopback
2021-07-19 08:53:13 +02:00
net: ip: avoid OOM kills with large UDP sends over loopback
2021-07-19 08:53:13 +02:00
mac80211: remove iwlwifi specific workaround NDPs of null_response
2021-07-14 16:53:32 +02:00
netfilter: nft_tproxy: restrict support to TCP and UDP transport protocols
2021-07-14 16:53:30 +02:00
netlabel: Fix memory leak in netlbl_mgmt_add_common
2021-07-14 16:53:29 +02:00
net/packet: annotate accesses to po->ifindex
2021-06-30 08:47:48 -04:00
net: sched: fix error return code in tcf_del_walker()
2021-07-19 08:53:11 +02:00
sctp: add size validation when walking chunks
2021-07-19 08:53:13 +02:00
SUNRPC: Should wake up the privileged task firstly.
2021-07-14 16:53:05 +02:00
tls: prevent oversized sendfile() hangs by ignoring MSG_MORE
2021-07-14 16:53:31 +02:00
vsock: notify server to shutdown when client has pending signal
2021-07-19 08:53:12 +02:00
wireless: wext-spy: Fix out-of-bounds warning
2021-07-19 08:53:12 +02:00
xfrm: Fix error reporting in xfrm_state_construct.
2021-07-19 08:53:11 +02:00
a01745edc1