From: Neil Horman <nhorman@tuxdriver.com>
To: Xin Long <lucien.xin@gmail.com>
Cc: network dev <netdev@vger.kernel.org>,
linux-sctp@vger.kernel.org,
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>,
davem@davemloft.net
Subject: Re: [PATCHv2 net-next 1/4] sctp: define subscribe in sctp_sock as __u16
Date: Tue, 13 Nov 2018 12:15:21 -0500 [thread overview]
Message-ID: <20181113171521.GB7568@neilslaptop.think-freely.org> (raw)
In-Reply-To: <82150b4fab9e70377db3db9c62fd10323be3f294.1542089666.git.lucien.xin@gmail.com>
On Tue, Nov 13, 2018 at 02:24:53PM +0800, Xin Long wrote:
>
> /* Default Peer Address Parameters. These defaults can
> * be modified via SCTP_PEER_ADDR_PARAMS
> @@ -5267,14 +5274,24 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
> static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
> int __user *optlen)
> {
> + struct sctp_event_subscribe subscribe;
> + __u8 *sn_type = (__u8 *)&subscribe;
> + int i;
> +
> if (len == 0)
> return -EINVAL;
> if (len > sizeof(struct sctp_event_subscribe))
> len = sizeof(struct sctp_event_subscribe);
> if (put_user(len, optlen))
> return -EFAULT;
> - if (copy_to_user(optval, &sctp_sk(sk)->subscribe, len))
> +
> + for (i = 0; i <= len; i++)
> + sn_type[i] = sctp_ulpevent_type_enabled(sctp_sk(sk)->subscribe,
> + SCTP_SN_TYPE_BASE + i);
> +
This seems like an off by one error. sctp_event_subscribe has N bytes in it (1
byte for each event), meaning that that events 0-(N-1) are subscribable.
Iterating this loop imples that you are going to check N events, overrunning the
sctp_event_subscribe struct.
Neil
>
WARNING: multiple messages have this Message-ID (diff)
From: Neil Horman <nhorman@tuxdriver.com>
To: Xin Long <lucien.xin@gmail.com>
Cc: network dev <netdev@vger.kernel.org>,
linux-sctp@vger.kernel.org,
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>,
davem@davemloft.net
Subject: Re: [PATCHv2 net-next 1/4] sctp: define subscribe in sctp_sock as __u16
Date: Tue, 13 Nov 2018 17:15:21 +0000 [thread overview]
Message-ID: <20181113171521.GB7568@neilslaptop.think-freely.org> (raw)
In-Reply-To: <82150b4fab9e70377db3db9c62fd10323be3f294.1542089666.git.lucien.xin@gmail.com>
On Tue, Nov 13, 2018 at 02:24:53PM +0800, Xin Long wrote:
>
> /* Default Peer Address Parameters. These defaults can
> * be modified via SCTP_PEER_ADDR_PARAMS
> @@ -5267,14 +5274,24 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
> static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
> int __user *optlen)
> {
> + struct sctp_event_subscribe subscribe;
> + __u8 *sn_type = (__u8 *)&subscribe;
> + int i;
> +
> if (len = 0)
> return -EINVAL;
> if (len > sizeof(struct sctp_event_subscribe))
> len = sizeof(struct sctp_event_subscribe);
> if (put_user(len, optlen))
> return -EFAULT;
> - if (copy_to_user(optval, &sctp_sk(sk)->subscribe, len))
> +
> + for (i = 0; i <= len; i++)
> + sn_type[i] = sctp_ulpevent_type_enabled(sctp_sk(sk)->subscribe,
> + SCTP_SN_TYPE_BASE + i);
> +
This seems like an off by one error. sctp_event_subscribe has N bytes in it (1
byte for each event), meaning that that events 0-(N-1) are subscribable.
Iterating this loop imples that you are going to check N events, overrunning the
sctp_event_subscribe struct.
Neil
>
next prev parent reply other threads:[~2018-11-14 3:15 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-13 6:24 [PATCHv2 net-next 0/4] sctp: add subscribe per asoc and sockopt SCTP_EVENT Xin Long
2018-11-13 6:24 ` Xin Long
2018-11-13 6:24 ` [PATCHv2 net-next 1/4] sctp: define subscribe in sctp_sock as __u16 Xin Long
2018-11-13 6:24 ` Xin Long
2018-11-13 6:24 ` [PATCHv2 net-next 2/4] sctp: add subscribe per asoc Xin Long
2018-11-13 6:24 ` Xin Long
2018-11-13 6:24 ` [PATCHv2 net-next 3/4] sctp: rename enum sctp_event to sctp_event_type Xin Long
2018-11-13 6:24 ` Xin Long
2018-11-13 6:24 ` [PATCHv2 net-next 4/4] sctp: add sockopt SCTP_EVENT Xin Long
2018-11-13 6:24 ` Xin Long
2018-11-13 17:15 ` Neil Horman [this message]
2018-11-13 17:15 ` [PATCHv2 net-next 1/4] sctp: define subscribe in sctp_sock as __u16 Neil Horman
2018-11-14 15:11 ` Xin Long
2018-11-14 15:11 ` Xin Long
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181113171521.GB7568@neilslaptop.think-freely.org \
--to=nhorman@tuxdriver.com \
--cc=davem@davemloft.net \
--cc=linux-sctp@vger.kernel.org \
--cc=lucien.xin@gmail.com \
--cc=marcelo.leitner@gmail.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.