From: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Date: Thu, 14 Sep 2017 02:00:54 +0300 > This code causes a static checker warning because Smatch doesn't trust > anything that comes from skb->data. I've reviewed this code and I do > think skb->data can be controlled by the user here. > > The sctp_event_subscribe struct has 13 __u8 fields and we want to see > if ours is non-zero. sn_type can be any value in the 0-USHRT_MAX range. > We're subtracting SCTP_SN_TYPE_BASE which is 1 << 15 so we could read > either before the start of the struct or after the end. > > This is a very old bug and it's surprising that it would go undetected > for so long but my theory is that it just doesn't have a big impact so > it would be hard to notice. > > Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> > --- > v2: Use reverse-christmas-tree local variable ordering. Applied and queued up for -stable, thanks. -- To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
