This is a note to let you know that I've just added the patch titled
fixup: sctp: verify size of a new chunk in _sctp_make_chunk()
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
fixup-sctp-verify-size-of-a-new-chunk-in-_sctp_make_chunk.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From gregkh@xxxxxxxxxxxxxxxxxxx Fri Mar 16 14:27:34 2018
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Date: Tue, 13 Mar 2018 10:56:00 +0100
Subject: fixup: sctp: verify size of a new chunk in _sctp_make_chunk()
To: Ben Hutchings <ben.hutchings@xxxxxxxxxxxxxxx>
Cc: linux-kernel@xxxxxxxxxxxxxxx, stable@xxxxxxxxxxxxxxx, Alexey Kodanev <alexey.kodanev@xxxxxxxxxx>, Marcelo Ricardo Leitner <marcelo.leinter@xxxxxxxxx>, Neil Horman <nhorman@xxxxxxxxxxxxx>, "David S. Miller" <davem@xxxxxxxxxxxxx>
Message-ID: <20180313095600.GA5131@xxxxxxxxx>
Content-Disposition: inline
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Ben writes:
> > + int chunklen;
> > +
> > + chunklen = sizeof(*chunk_hdr) + paylen;
>
> I think this length still needs to be rounded up (with WORD_ROUND here,
> instead of SCTP_PAD4 upstream).
So here's a fix for this problem.
Reported-by: Ben Hutchings <ben.hutchings@xxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/sctp/sm_make_chunk.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1369,7 +1369,7 @@ static struct sctp_chunk *_sctp_make_chu
struct sock *sk;
int chunklen;
- chunklen = sizeof(*chunk_hdr) + paylen;
+ chunklen = WORD_ROUND(sizeof(*chunk_hdr) + paylen);
if (chunklen > SCTP_MAX_CHUNK_LEN)
goto nodata;
Patches currently in stable-queue which might be from gregkh@xxxxxxxxxxxxxxxxxxx are
queue-4.4/tc358743-fix-register-i2c_rd-wr-function-fix.patch
queue-4.4/netfilter-add-back-stackpointer-size-checks.patch
queue-4.4/watchdog-hpwdt-fix-unused-variable-warning.patch
queue-4.4/scsi-qla2xxx-fix-null-pointer-crash-due-to-active-timer-for-abts.patch
queue-4.4/watchdog-hpwdt-smbios-check.patch
queue-4.4/drm-amdgpu-notify-sbios-device-ready-before-send-request.patch
queue-4.4/workqueue-allow-retrieval-of-current-task-s-work-struct.patch
queue-4.4/loop-fix-lost-writes-caused-by-missing-flag.patch
queue-4.4/rdma-ucma-limit-possible-option-size.patch
queue-4.4/alsa-seq-don-t-allow-resizing-pool-in-use.patch
queue-4.4/netfilter-x_tables-pack-percpu-counter-allocations.patch
queue-4.4/serial-sh-sci-prevent-lockup-on-full-tty-buffers.patch
queue-4.4/revert-arm-dts-logicpd-torpedo-fix-i2c1-pinmux.patch
queue-4.4/serial-8250_pci-add-brainboxes-uc-260-4-port-serial-device.patch
queue-4.4/arm-omap2-hide-omap3_save_secure_ram-on-non-omap3-builds.patch
queue-4.4/usb-usbmon-read-text-within-supplied-buffer-size.patch
queue-4.4/x86-mce-serialize-sysfs-changes.patch
queue-4.4/alsa-hda-add-dock-and-led-support-for-hp-probook-640-g2.patch
queue-4.4/netfilter-idletimer-be-syzkaller-friendly.patch
queue-4.4/netfilter-use-skb_to_full_sk-in-ip_route_me_harder.patch
queue-4.4/usb-gadget-f_fs-fix-use-after-free-in-ffs_fs_kill_sb.patch
queue-4.4/usb-storage-add-jmicron-bridge-152d-2567-to-unusual_devs.h.patch
queue-4.4/drm-radeon-fix-kv-harvesting.patch
queue-4.4/usb-quirks-add-control-message-delay-for-1b1c-1b20.patch
queue-4.4/x86-module-detect-and-skip-invalid-relocations.patch
queue-4.4/ubi-fix-race-condition-between-ubi-volume-creation-and-udev.patch
queue-4.4/drm-radeon-fix-deadlock-on-runtime-suspend.patch
queue-4.4/scsi-qla2xxx-replace-fcport-alloc-with-qla2x00_alloc_fcport.patch
queue-4.4/alsa-hda-add-dock-and-led-support-for-hp-elitebook-820-g3.patch
queue-4.4/watchdog-hpwdt-check-source-of-nmi.patch
queue-4.4/netfilter-ipv6-fix-use-after-free-write-in-nf_nat_ipv6_manip_pkt.patch
queue-4.4/mips-bmips-do-not-mask-ipis-during-suspend.patch
queue-4.4/netfilter-x_tables-pass-xt_counters-struct-instead-of-packet-counter.patch
queue-4.4/staging-comedi-fix-comedi_nsamples_left.patch
queue-4.4/rdma-ucma-check-that-user-doesn-t-overflow-qp-state.patch
queue-4.4/fixup-sctp-verify-size-of-a-new-chunk-in-_sctp_make_chunk.patch
queue-4.4/nospec-include-asm-barrier.h-dependency.patch
queue-4.4/netfilter-ebtables-config_compat-don-t-trust-userland-offsets.patch
queue-4.4/drm-amdgpu-fix-deadlock-on-runtime-suspend.patch
queue-4.4/alsa-seq-more-protection-for-concurrent-write-and-ioctl-races.patch
queue-4.4/nfs-fix-an-incorrect-type-in-struct-nfs_direct_req.patch
queue-4.4/netfilter-nfnetlink_queue-fix-timestamp-attribute.patch
queue-4.4/mips-ath25-check-for-kzalloc-allocation-failure.patch
queue-4.4/x86-treat-r_x86_64_plt32-as-r_x86_64_pc32.patch
queue-4.4/usb-usbmon-remove-assignment-from-is_err-argument.patch
queue-4.4/bcache-don-t-attach-backing-with-duplicate-uuid.patch
queue-4.4/kbuild-handle-builtin-dtb-file-names-containing-hyphens.patch
queue-4.4/uas-fix-comparison-for-error-code.patch
queue-4.4/drm-allow-determining-if-current-task-is-output-poll-worker.patch
queue-4.4/netfilter-bridge-ebt_among-add-missing-match-size-checks.patch
queue-4.4/staging-android-ashmem-fix-lockdep-issue-during-llseek.patch
queue-4.4/netfilter-nat-cope-with-negative-port-range.patch
queue-4.4/netfilter-x_tables-fix-missing-timer-initialization-in-xt_led.patch
queue-4.4/ext4-inplace-xattr-block-update-fails-to-deduplicate-blocks.patch
queue-4.4/input-tca8418_keypad-remove-double-read-of-key-event-register.patch
queue-4.4/alsa-hda-realtek-fix-dock-line-out-volume-on-dell-precision-7520.patch
queue-4.4/drm-amdgpu-fix-kv-harvesting.patch
queue-4.4/drm-nouveau-fix-deadlock-on-runtime-suspend.patch
queue-4.4/tty-serial-atmel-add-new-version-check-for-usart.patch
queue-4.4/input-matrix_keypad-fix-race-when-disabling-interrupts.patch
queue-4.4/mips-octeon-irq-check-for-null-return-on-kzalloc-allocation.patch
queue-4.4/netfilter-x_tables-pass-xt_counters-struct-to-counter-allocator.patch
queue-4.4/rdma-mlx5-fix-integer-overflow-while-resizing-cq.patch