From: Dan Carpenter <dan.carpen...@oracle.com> Date: Thu, 14 Sep 2017 02:00:54 +0300
> This code causes a static checker warning because Smatch doesn't trust > anything that comes from skb->data. I've reviewed this code and I do > think skb->data can be controlled by the user here. > > The sctp_event_subscribe struct has 13 __u8 fields and we want to see > if ours is non-zero. sn_type can be any value in the 0-USHRT_MAX range. > We're subtracting SCTP_SN_TYPE_BASE which is 1 << 15 so we could read > either before the start of the struct or after the end. > > This is a very old bug and it's surprising that it would go undetected > for so long but my theory is that it just doesn't have a big impact so > it would be hard to notice. > > Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> > --- > v2: Use reverse-christmas-tree local variable ordering. Applied and queued up for -stable, thanks.
