From: Eiichi Tsukata <eiichi.tsukata@xxxxxxxxxxx>
"stream_len" is not always multiple of 4. Account padding length
which can be added in sctp_addto_chunk() for reconf chunk.
Cc: Vlad Yasevich <vyasevich@xxxxxxxxx>
Cc: Neil Horman <nhorman@xxxxxxxxxxxxx>
Cc: Marcelo Ricardo Leitner <marcelo.leitner@xxxxxxxxx>
Cc: "David S. Miller" <davem@xxxxxxxxxxxxx>
Cc: Jakub Kicinski <kuba@xxxxxxxxxx>
Cc: linux-sctp@xxxxxxxxxxxxxxx
Cc: netdev@xxxxxxxxxxxxxxx
Cc: linux-kernel@xxxxxxxxxxxxxxx
Fixes: cc16f00f6529 ("sctp: add support for generating stream reconf ssn reset request chunk")
Reported-by: syzbot <syzkaller@xxxxxxxxxxxxxxxx>
Cc: stable <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@xxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/sctp/sm_make_chunk.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index b8fa8f1a7277..f7a1072a2a2a 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -3694,8 +3694,8 @@ struct sctp_chunk *sctp_make_strreset_req(
struct sctp_chunk *retval;
__u16 outlen, inlen;
- outlen = (sizeof(outreq) + stream_len) * out;
- inlen = (sizeof(inreq) + stream_len) * in;
+ outlen = (sizeof(outreq) + SCTP_PAD4(stream_len)) * out;
+ inlen = (sizeof(inreq) + SCTP_PAD4(stream_len)) * in;
retval = sctp_make_reconf(asoc, outlen + inlen);
if (!retval)
--
2.33.0
