[SCTP]: Fix panic's when receiving fragmented SCTP control chunks. (CVE-2006-2272)
Linux Kernel Mailing List <[email protected]> Tue, 13 Jun 2006 19:59:21 GMT
| Newsgroups | gmane.linux.kernel.commits.2-4 |
|---|---|
| Message-ID | <[email protected]> |
commit 13c55afa98dfba769941448e59269959737af057 tree a5446cd8d91aa1e6c02b624c7a45fc6e80c7bde0 parent ff6c55bb3febfeeac029a7ebf866bae0cbf32921 author Sridhar Samudrala <[email protected]> Mon, 29 May 2006 13:33:47 -0700 committer David S. Miller <[email protected]> Mon, 29 May 2006 13:33:47 -0700 [SCTP]: Fix panic's when receiving fragmented SCTP control chunks. (CVE-2006-2272) Use pskb_pull() to handle incoming COOKIE_ECHO and HEARTBEAT chunks that are received as skb's with fragment list. Signed-off-by: Sridhar Samudrala <[email protected]> Signed-off-by: David S. Miller <[email protected]> net/sctp/sm_statefuns.c | 13 ++++++++----- 1 files changed, 8 insertions(+), 5 deletions(-) diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index c581808..b5ce4fb 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -619,8 +619,9 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(co */ chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data; - skb_pull(chunk->skb, - ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t)); + if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) - + sizeof(sctp_chunkhdr_t))) + goto nomem; /* 5.1 D) Upon reception of the COOKIE ECHO chunk, Endpoint * "Z" will reply with a COOKIE ACK chunk after building a TCB @@ -949,7 +950,8 @@ sctp_disposition_t sctp_sf_beat_8_3(cons */ chunk->subh.hb_hdr = (sctp_heartbeathdr_t *) chunk->skb->data; paylen = ntohs(chunk->chunk_hdr->length) - sizeof(sctp_chunkhdr_t); - skb_pull(chunk->skb, paylen); + if (!pskb_pull(chunk->skb, paylen)) + goto nomem; reply = sctp_make_heartbeat_ack(asoc, chunk, chunk->subh.hb_hdr, paylen); @@ -1832,8 +1834,9 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupc * are in good shape. */ chunk->subh.cookie_hdr = (struct sctp_signed_cookie *)chunk->skb->data; - skb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) - - sizeof(sctp_chunkhdr_t)); + if (!pskb_pull(chunk->skb, ntohs(chunk->chunk_hdr->length) - + sizeof(sctp_chunkhdr_t))) + goto nomem; /* In RFC 2960 5.2.4 3, if both Verification Tags in the State Cookie * of a duplicate COOKIE ECHO match the Verification Tags of the