* [PATCH] net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory
@ 2016-01-07 19:52 Sasha Levin
2016-01-10 23:01 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Sasha Levin @ 2016-01-07 19:52 UTC (permalink / raw)
To: vyasevich, nhorman, davem; +Cc: netdev, linux-kernel, Sasha Levin
proc_dostring() needs an initialized destination string, while the one
provided in proc_sctp_do_hmac_alg() contains stack garbage.
Thus, writing to cookie_hmac_alg would strlen() that garbage and end up
accessing invalid memory.
Fixes: 3c68198e7 ("sctp: Make hmac algorithm selection for cookie generation dynamic")
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
---
net/sctp/sysctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index ccbfc93..daf8554 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -327,7 +327,7 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
struct ctl_table tbl;
bool changed = false;
char *none = "none";
- char tmp[8];
+ char tmp[8] = {0};
int ret;
memset(&tbl, 0, sizeof(struct ctl_table));
--
1.7.10.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory
2016-01-07 19:52 [PATCH] net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory Sasha Levin
@ 2016-01-10 23:01 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2016-01-10 23:01 UTC (permalink / raw)
To: sasha.levin; +Cc: vyasevich, nhorman, netdev, linux-kernel
From: Sasha Levin <sasha.levin@oracle.com>
Date: Thu, 7 Jan 2016 14:52:43 -0500
> proc_dostring() needs an initialized destination string, while the one
> provided in proc_sctp_do_hmac_alg() contains stack garbage.
>
> Thus, writing to cookie_hmac_alg would strlen() that garbage and end up
> accessing invalid memory.
>
> Fixes: 3c68198e7 ("sctp: Make hmac algorithm selection for cookie generation dynamic")
> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Applied and queued up for -stable, thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-01-10 23:01 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-01-07 19:52 [PATCH] net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory Sasha Levin
2016-01-10 23:01 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).