From: Xin Long <lucien.xin@xxxxxxxxx>
Date: Mon, 29 Oct 2018 23:13:11 +0800
> When getting pr_assocstatus and pr_streamstatus by sctp_getsockopt,
> it doesn't correctly process the case when policy is set with
> SCTP_PR_SCTP_ALL | SCTP_PR_SCTP_MASK. It even causes a
> slab-out-of-bounds in sctp_getsockopt_pr_streamstatus().
>
> This patch fixes it by return -EINVAL for this case.
>
> Fixes: 0ac1077e3a54 ("sctp: get pr_assoc and pr_stream all status with SCTP_PR_SCTP_ALL")
> Reported-by: syzbot+5da0d0a72a9e7d791748@xxxxxxxxxxxxxxxxxxxxxxxxx
> Suggested-by: Marcelo Ricardo Leitner <marcelo.leitner@xxxxxxxxx>
> Signed-off-by: Xin Long <lucien.xin@xxxxxxxxx>
Applied and queued up for -stable.
