* [patch] sctp: check len in sctp_getsockopt_assoc_stats()
@ 2013-02-27 20:41 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2013-02-27 20:41 UTC (permalink / raw)
To: Vlad Yasevich, Michele Baldessari
Cc: Sridhar Samudrala, Neil Horman, David S. Miller, linux-sctp,
netdev, kernel-janitors
This check is missing an upper bound.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
This should go in 3.8 -stable as well.
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index c99458d..fbd8386 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5652,6 +5652,8 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
/* User must provide at least the assoc id */
if (len < sizeof(sctp_assoc_t))
return -EINVAL;
+ if (len > sizeof(struct sctp_assoc_stats))
+ len = sizeof(struct sctp_assoc_stats);
if (copy_from_user(&sas, optval, len))
return -EFAULT;
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [patch] sctp: check len in sctp_getsockopt_assoc_stats()
@ 2013-02-27 20:41 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2013-02-27 20:41 UTC (permalink / raw)
To: Vlad Yasevich, Michele Baldessari
Cc: Sridhar Samudrala, Neil Horman, David S. Miller, linux-sctp,
netdev, kernel-janitors
This check is missing an upper bound.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
This should go in 3.8 -stable as well.
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index c99458d..fbd8386 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5652,6 +5652,8 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
/* User must provide at least the assoc id */
if (len < sizeof(sctp_assoc_t))
return -EINVAL;
+ if (len > sizeof(struct sctp_assoc_stats))
+ len = sizeof(struct sctp_assoc_stats);
if (copy_from_user(&sas, optval, len))
return -EFAULT;
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [patch] sctp: check len in sctp_getsockopt_assoc_stats()
2013-02-27 20:41 ` Dan Carpenter
@ 2013-02-27 20:45 ` David Miller
-1 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2013-02-27 20:45 UTC (permalink / raw)
To: dan.carpenter
Cc: vyasevich, michele, sri, nhorman, linux-sctp, netdev, kernel-janitors
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 27 Feb 2013 23:41:44 +0300
> This check is missing an upper bound.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> This should go in 3.8 -stable as well.
There is a discussion and patch on netdev already.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [patch] sctp: check len in sctp_getsockopt_assoc_stats()
@ 2013-02-27 20:45 ` David Miller
0 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2013-02-27 20:45 UTC (permalink / raw)
To: dan.carpenter
Cc: vyasevich, michele, sri, nhorman, linux-sctp, netdev, kernel-janitors
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 27 Feb 2013 23:41:44 +0300
> This check is missing an upper bound.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> This should go in 3.8 -stable as well.
There is a discussion and patch on netdev already.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2013-02-27 20:45 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-02-27 20:41 [patch] sctp: check len in sctp_getsockopt_assoc_stats() Dan Carpenter
2013-02-27 20:41 ` Dan Carpenter
2013-02-27 20:45 ` David Miller
2013-02-27 20:45 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.