This is a note to let you know that I've just added the patch titled
fixup: sctp: verify size of a new chunk in _sctp_make_chunk()
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
fixup-sctp-verify-size-of-a-new-chunk-in-_sctp_make_chunk.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From gregkh@xxxxxxxxxxxxxxxxxxx Fri Mar 16 14:27:34 2018
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Date: Tue, 13 Mar 2018 10:56:00 +0100
Subject: fixup: sctp: verify size of a new chunk in _sctp_make_chunk()
To: Ben Hutchings <ben.hutchings@xxxxxxxxxxxxxxx>
Cc: linux-kernel@xxxxxxxxxxxxxxx, stable@xxxxxxxxxxxxxxx, Alexey Kodanev <alexey.kodanev@xxxxxxxxxx>, Marcelo Ricardo Leitner <marcelo.leinter@xxxxxxxxx>, Neil Horman <nhorman@xxxxxxxxxxxxx>, "David S. Miller" <davem@xxxxxxxxxxxxx>
Message-ID: <20180313095600.GA5131@xxxxxxxxx>
Content-Disposition: inline
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Ben writes:
> > + int chunklen;
> > +
> > + chunklen = sizeof(*chunk_hdr) + paylen;
>
> I think this length still needs to be rounded up (with WORD_ROUND here,
> instead of SCTP_PAD4 upstream).
So here's a fix for this problem.
Reported-by: Ben Hutchings <ben.hutchings@xxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/sctp/sm_make_chunk.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1369,7 +1369,7 @@ static struct sctp_chunk *_sctp_make_chu
struct sock *sk;
int chunklen;
- chunklen = sizeof(*chunk_hdr) + paylen;
+ chunklen = WORD_ROUND(sizeof(*chunk_hdr) + paylen);
if (chunklen > SCTP_MAX_CHUNK_LEN)
goto nodata;
Patches currently in stable-queue which might be from gregkh@xxxxxxxxxxxxxxxxxxx are
queue-3.18/scsi-qla2xxx-fix-null-pointer-crash-due-to-active-timer-for-abts.patch
queue-3.18/scripts-recordmcount-break-hardlinks.patch
queue-3.18/alsa-seq-don-t-allow-resizing-pool-in-use.patch
queue-3.18/serial-sh-sci-prevent-lockup-on-full-tty-buffers.patch
queue-3.18/serial-8250_pci-add-brainboxes-uc-260-4-port-serial-device.patch
queue-3.18/usb-usbmon-read-text-within-supplied-buffer-size.patch
queue-3.18/x86-mce-serialize-sysfs-changes.patch
queue-3.18/netfilter-idletimer-be-syzkaller-friendly.patch
queue-3.18/usb-quirks-add-control-message-delay-for-1b1c-1b20.patch
queue-3.18/x86-module-detect-and-skip-invalid-relocations.patch
queue-3.18/ubi-fix-race-condition-between-ubi-volume-creation-and-udev.patch
queue-3.18/netfilter-ipv6-fix-use-after-free-write-in-nf_nat_ipv6_manip_pkt.patch
queue-3.18/mips-bmips-do-not-mask-ipis-during-suspend.patch
queue-3.18/fixup-sctp-verify-size-of-a-new-chunk-in-_sctp_make_chunk.patch
queue-3.18/netfilter-ebtables-config_compat-don-t-trust-userland-offsets.patch
queue-3.18/alsa-seq-more-protection-for-concurrent-write-and-ioctl-races.patch
queue-3.18/x86-treat-r_x86_64_plt32-as-r_x86_64_pc32.patch
queue-3.18/usb-usbmon-remove-assignment-from-is_err-argument.patch
queue-3.18/uas-fix-comparison-for-error-code.patch
queue-3.18/netfilter-bridge-ebt_among-add-missing-match-size-checks.patch
queue-3.18/staging-android-ashmem-fix-lockdep-issue-during-llseek.patch
queue-3.18/netfilter-nat-cope-with-negative-port-range.patch
queue-3.18/netfilter-x_tables-fix-missing-timer-initialization-in-xt_led.patch
queue-3.18/tty-serial-atmel-add-new-version-check-for-usart.patch
queue-3.18/input-matrix_keypad-fix-race-when-disabling-interrupts.patch