Re: net/sctp: out-of-bounds access in sctp_add_bind_addr

On Mon, Jan 25, 2016 at 02:16:00PM -0200, Marcelo Ricardo Leitner wrote: > Something like this. Builds, but UNTESTED. > Uses union sizeof where possible but when reading from a buffer that is > not aligned to it, like that user supplied one. Then relies on > af->sockaddr_len > > --8<-- > > --- >

Re: net/sctp: out-of-bounds access in sctp_add_bind_addr

Something like this. Builds, but UNTESTED. Uses union sizeof where possible but when reading from a buffer that is not aligned to it, like that user supplied one. Then relies on af->sockaddr_len --8<-- --- include/net/sctp/structs.h | 2 +- net/sctp/bind_addr.c | 14 -- net/sc

Re: net/sctp: out-of-bounds access in sctp_add_bind_addr

On Mon, Jan 25, 2016 at 12:48:02PM -0200, Marcelo Ricardo Leitner wrote: > On Mon, Jan 25, 2016 at 03:42:14PM +0100, Dmitry Vyukov wrote: > > On Mon, Jan 25, 2016 at 3:31 PM, Neil Horman wrote: > > > On Mon, Jan 25, 2016 at 03:02:38PM +0100, Dmitry Vyukov wrote: > > >> Hello, > > >> > > >> I've gi

Re: net/sctp: out-of-bounds access in sctp_add_bind_addr

On Mon, Jan 25, 2016 at 03:42:14PM +0100, Dmitry Vyukov wrote: > On Mon, Jan 25, 2016 at 3:31 PM, Neil Horman wrote: > > On Mon, Jan 25, 2016 at 03:02:38PM +0100, Dmitry Vyukov wrote: > >> Hello, > >> > >> I've git the following error report while running syzkaller fuzzer: > >> > >> ==

Re: net/sctp: out-of-bounds access in sctp_add_bind_addr

On Mon, Jan 25, 2016 at 3:31 PM, Neil Horman wrote: > On Mon, Jan 25, 2016 at 03:02:38PM +0100, Dmitry Vyukov wrote: >> Hello, >> >> I've git the following error report while running syzkaller fuzzer: >> >> == >> BUG: KASAN: slab-out-

Re: net/sctp: out-of-bounds access in sctp_add_bind_addr

On Mon, Jan 25, 2016 at 03:02:38PM +0100, Dmitry Vyukov wrote: > Hello, > > I've git the following error report while running syzkaller fuzzer: > > == > BUG: KASAN: slab-out-of-bounds in memcpy+0x1d/0x40 at addr 88006c6361e8 > Re