From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752258AbdGDSsu (ORCPT ); Tue, 4 Jul 2017 14:48:50 -0400 Received: from imap0.codethink.co.uk ([185.43.218.159]:49597 "EHLO imap0.codethink.co.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752215AbdGDSst (ORCPT ); Tue, 4 Jul 2017 14:48:49 -0400 Message-ID: <1499194116.1935.90.camel@codethink.co.uk> Subject: Re: [PATCH 4.4 057/101] net: sctp: fix array overrun read on sctp_timer_tbl From: Ben Hutchings To: Greg Kroah-Hartman Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org, "David S. Miller" , Colin Ian King , Sasha Levin Date: Tue, 04 Jul 2017 19:48:36 +0100 In-Reply-To: <20170703133343.987327646@linuxfoundation.org> References: <20170703133334.237346187@linuxfoundation.org> <20170703133343.987327646@linuxfoundation.org> Organization: Codethink Ltd. Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.12.9-1+b1 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 2017-07-03 at 15:34 +0200, Greg Kroah-Hartman wrote: > 4.4-stable review patch. If anyone has any objections, please let me know. > > ------------------ > > From: Colin Ian King > > > [ Upstream commit 0e73fc9a56f22f2eec4d2b2910c649f7af67b74d ] > > The comparison on the timeout can lead to an array overrun > read on sctp_timer_tbl because of an off-by-one error. [...] The off-by-one error was only introduced in 4.11 by: commit 7b9438de0cd4b46a6914416bfede6cf839cd9e68 Author: Xin Long Date: Wed Jan 18 00:44:43 2017 +0800 sctp: add stream reconf timer So it is harmless but also useless to apply this to 4.4 and 4.9. Ben. -- Ben Hutchings Software Developer, Codethink Ltd.