This sockopt accepts two kinds of parameters, using struct
sctp_sack_info and struct sctp_assoc_value. The mentioned commit didn't
notice an implicit cast from the smaller (latter) struct to the bigger
one (former) when copying the data from the user space, which now leads
to an attempt to write beyond the buffer (because it assumes the storing
buffer is bigger than the parameter itself).
Fix it by giving it a special buffer if the smaller struct is used by
the application.
Fixes: ebb25defdc17 ("sctp: pass a kernel pointer to
sctp_setsockopt_delayed_ack")
Reported-by: syzbot+0e4699d000d8b874d...@syzkaller.appspotmail.com
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leit...@gmail.com>
---
net/sctp/socket.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index
9a767f35971865f46b39131fc8d96d8c3c2aa1a8..b71c36af7687247b4fc9e160219b76f5c41b2fe2
100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -2756,6 +2756,7 @@ static int sctp_setsockopt_delayed_ack(struct sock *sk,
{
struct sctp_sock *sp = sctp_sk(sk);
struct sctp_association *asoc;
+ struct sctp_sack_info _params;
if (optlen == sizeof(struct sctp_sack_info)) {
if (params->sack_delay == 0 && params->sack_freq == 0)
@@ -2767,7 +2768,9 @@ static int sctp_setsockopt_delayed_ack(struct sock *sk,
"Use struct sctp_sack_info instead\n",
current->comm, task_pid_nr(current));
- if (params->sack_delay == 0)
+ memcpy(&_params, params, sizeof(struct sctp_assoc_value));
+ params = &_params;
+ if (((struct sctp_assoc_value *)params)->assoc_value == 0)
params->sack_freq = 1;
else
params->sack_freq = 0;
--
2.25.4
