Re: [PATCH net-next] sctp: fix slab-out-of-bounds in SCTP_DELAYED_SACK processing

2020-07-23 Thread Christoph Hellwig
On Thu, Jul 23, 2020 at 12:30:25PM -0300, Marcelo Ricardo Leitner wrote: > On Thu, Jul 23, 2020 at 11:22:38AM +0200, Christoph Hellwig wrote: > > On Wed, Jul 22, 2020 at 05:42:31PM -0300, Marcelo Ricardo Leitner wrote: > > > Cc'ing linux-s...@vger.kernel.org. > > > > What do you think of this vers

Re: [PATCH net-next] sctp: fix slab-out-of-bounds in SCTP_DELAYED_SACK processing

2020-07-23 Thread Marcelo Ricardo Leitner
On Thu, Jul 23, 2020 at 11:22:38AM +0200, Christoph Hellwig wrote: > On Wed, Jul 22, 2020 at 05:42:31PM -0300, Marcelo Ricardo Leitner wrote: > > Cc'ing linux-s...@vger.kernel.org. > > What do you think of this version, which I think is a little cleaner? It splits up the argument parsing from the

Re: [PATCH net-next] sctp: fix slab-out-of-bounds in SCTP_DELAYED_SACK processing

2020-07-23 Thread Christoph Hellwig
On Wed, Jul 22, 2020 at 05:42:31PM -0300, Marcelo Ricardo Leitner wrote: > Cc'ing linux-s...@vger.kernel.org. What do you think of this version, which I think is a little cleaner? diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 9a767f35971865..6ce460428af9f3 100644 --- a/net/sctp/socket

Re: [PATCH net-next] sctp: fix slab-out-of-bounds in SCTP_DELAYED_SACK processing

2020-07-22 Thread Marcelo Ricardo Leitner
Cc'ing linux-s...@vger.kernel.org. On Wed, Jul 22, 2020 at 05:38:58PM -0300, Marcelo Ricardo Leitner wrote: > This sockopt accepts two kinds of parameters, using struct > sctp_sack_info and struct sctp_assoc_value. The mentioned commit didn't > notice an implicit cast from the smaller (latter) str

[PATCH net-next] sctp: fix slab-out-of-bounds in SCTP_DELAYED_SACK processing

2020-07-22 Thread Marcelo Ricardo Leitner
This sockopt accepts two kinds of parameters, using struct sctp_sack_info and struct sctp_assoc_value. The mentioned commit didn't notice an implicit cast from the smaller (latter) struct to the bigger one (former) when copying the data from the user space, which now leads to an attempt to write be