mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-11 12:28:41 +08:00
sctp: validate from_addr_param return
Ilja reported that, simply putting it, nothing was validating that from_addr_param functions were operating on initialized memory. That is, the parameter itself was being validated by sctp_walk_params, but it doesn't check for types and their specific sizes and it could be a 0-length one, causing from_addr_param to potentially work over the next parameter or even uninitialized memory. The fix here is to, in all calls to from_addr_param, check if enough space is there for the wanted IP address type. Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
9ea3e52c5b
commit
0c5dc070ff
@ -461,7 +461,7 @@ struct sctp_af {
|
||||
int saddr);
|
||||
void (*from_sk) (union sctp_addr *,
|
||||
struct sock *sk);
|
||||
void (*from_addr_param) (union sctp_addr *,
|
||||
bool (*from_addr_param) (union sctp_addr *,
|
||||
union sctp_addr_param *,
|
||||
__be16 port, int iif);
|
||||
int (*to_addr_param) (const union sctp_addr *,
|
||||
|
@ -270,22 +270,19 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list,
|
||||
rawaddr = (union sctp_addr_param *)raw_addr_list;
|
||||
|
||||
af = sctp_get_af_specific(param_type2af(param->type));
|
||||
if (unlikely(!af)) {
|
||||
if (unlikely(!af) ||
|
||||
!af->from_addr_param(&addr, rawaddr, htons(port), 0)) {
|
||||
retval = -EINVAL;
|
||||
sctp_bind_addr_clean(bp);
|
||||
break;
|
||||
goto out_err;
|
||||
}
|
||||
|
||||
af->from_addr_param(&addr, rawaddr, htons(port), 0);
|
||||
if (sctp_bind_addr_state(bp, &addr) != -1)
|
||||
goto next;
|
||||
retval = sctp_add_bind_addr(bp, &addr, sizeof(addr),
|
||||
SCTP_ADDR_SRC, gfp);
|
||||
if (retval) {
|
||||
if (retval)
|
||||
/* Can't finish building the list, clean up. */
|
||||
sctp_bind_addr_clean(bp);
|
||||
break;
|
||||
}
|
||||
goto out_err;
|
||||
|
||||
next:
|
||||
len = ntohs(param->length);
|
||||
@ -294,6 +291,12 @@ next:
|
||||
}
|
||||
|
||||
return retval;
|
||||
|
||||
out_err:
|
||||
if (retval)
|
||||
sctp_bind_addr_clean(bp);
|
||||
|
||||
return retval;
|
||||
}
|
||||
|
||||
/********************************************************************
|
||||
|
@ -1131,7 +1131,8 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct net *net,
|
||||
if (!af)
|
||||
continue;
|
||||
|
||||
af->from_addr_param(paddr, params.addr, sh->source, 0);
|
||||
if (!af->from_addr_param(paddr, params.addr, sh->source, 0))
|
||||
continue;
|
||||
|
||||
asoc = __sctp_lookup_association(net, laddr, paddr, transportp);
|
||||
if (asoc)
|
||||
@ -1174,7 +1175,8 @@ static struct sctp_association *__sctp_rcv_asconf_lookup(
|
||||
if (unlikely(!af))
|
||||
return NULL;
|
||||
|
||||
af->from_addr_param(&paddr, param, peer_port, 0);
|
||||
if (af->from_addr_param(&paddr, param, peer_port, 0))
|
||||
return NULL;
|
||||
|
||||
return __sctp_lookup_association(net, laddr, &paddr, transportp);
|
||||
}
|
||||
|
@ -551,15 +551,20 @@ static void sctp_v6_to_sk_daddr(union sctp_addr *addr, struct sock *sk)
|
||||
}
|
||||
|
||||
/* Initialize a sctp_addr from an address parameter. */
|
||||
static void sctp_v6_from_addr_param(union sctp_addr *addr,
|
||||
static bool sctp_v6_from_addr_param(union sctp_addr *addr,
|
||||
union sctp_addr_param *param,
|
||||
__be16 port, int iif)
|
||||
{
|
||||
if (ntohs(param->v6.param_hdr.length) < sizeof(struct sctp_ipv6addr_param))
|
||||
return false;
|
||||
|
||||
addr->v6.sin6_family = AF_INET6;
|
||||
addr->v6.sin6_port = port;
|
||||
addr->v6.sin6_flowinfo = 0; /* BUG */
|
||||
addr->v6.sin6_addr = param->v6.addr;
|
||||
addr->v6.sin6_scope_id = iif;
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/* Initialize an address parameter from a sctp_addr and return the length
|
||||
|
@ -254,14 +254,19 @@ static void sctp_v4_to_sk_daddr(union sctp_addr *addr, struct sock *sk)
|
||||
}
|
||||
|
||||
/* Initialize a sctp_addr from an address parameter. */
|
||||
static void sctp_v4_from_addr_param(union sctp_addr *addr,
|
||||
static bool sctp_v4_from_addr_param(union sctp_addr *addr,
|
||||
union sctp_addr_param *param,
|
||||
__be16 port, int iif)
|
||||
{
|
||||
if (ntohs(param->v4.param_hdr.length) < sizeof(struct sctp_ipv4addr_param))
|
||||
return false;
|
||||
|
||||
addr->v4.sin_family = AF_INET;
|
||||
addr->v4.sin_port = port;
|
||||
addr->v4.sin_addr.s_addr = param->v4.addr.s_addr;
|
||||
memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero));
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/* Initialize an address parameter from a sctp_addr and return the length
|
||||
|
@ -2346,11 +2346,13 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
|
||||
|
||||
/* Process the initialization parameters. */
|
||||
sctp_walk_params(param, peer_init, init_hdr.params) {
|
||||
if (!src_match && (param.p->type == SCTP_PARAM_IPV4_ADDRESS ||
|
||||
param.p->type == SCTP_PARAM_IPV6_ADDRESS)) {
|
||||
if (!src_match &&
|
||||
(param.p->type == SCTP_PARAM_IPV4_ADDRESS ||
|
||||
param.p->type == SCTP_PARAM_IPV6_ADDRESS)) {
|
||||
af = sctp_get_af_specific(param_type2af(param.p->type));
|
||||
af->from_addr_param(&addr, param.addr,
|
||||
chunk->sctp_hdr->source, 0);
|
||||
if (!af->from_addr_param(&addr, param.addr,
|
||||
chunk->sctp_hdr->source, 0))
|
||||
continue;
|
||||
if (sctp_cmp_addr_exact(sctp_source(chunk), &addr))
|
||||
src_match = 1;
|
||||
}
|
||||
@ -2531,7 +2533,8 @@ static int sctp_process_param(struct sctp_association *asoc,
|
||||
break;
|
||||
do_addr_param:
|
||||
af = sctp_get_af_specific(param_type2af(param.p->type));
|
||||
af->from_addr_param(&addr, param.addr, htons(asoc->peer.port), 0);
|
||||
if (!af->from_addr_param(&addr, param.addr, htons(asoc->peer.port), 0))
|
||||
break;
|
||||
scope = sctp_scope(peer_addr);
|
||||
if (sctp_in_scope(net, &addr, scope))
|
||||
if (!sctp_assoc_add_peer(asoc, &addr, gfp, SCTP_UNCONFIRMED))
|
||||
@ -2632,15 +2635,13 @@ do_addr_param:
|
||||
addr_param = param.v + sizeof(struct sctp_addip_param);
|
||||
|
||||
af = sctp_get_af_specific(param_type2af(addr_param->p.type));
|
||||
if (af == NULL)
|
||||
if (!af)
|
||||
break;
|
||||
|
||||
af->from_addr_param(&addr, addr_param,
|
||||
htons(asoc->peer.port), 0);
|
||||
if (!af->from_addr_param(&addr, addr_param,
|
||||
htons(asoc->peer.port), 0))
|
||||
break;
|
||||
|
||||
/* if the address is invalid, we can't process it.
|
||||
* XXX: see spec for what to do.
|
||||
*/
|
||||
if (!af->addr_valid(&addr, NULL, NULL))
|
||||
break;
|
||||
|
||||
@ -3054,7 +3055,8 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
|
||||
if (unlikely(!af))
|
||||
return SCTP_ERROR_DNS_FAILED;
|
||||
|
||||
af->from_addr_param(&addr, addr_param, htons(asoc->peer.port), 0);
|
||||
if (!af->from_addr_param(&addr, addr_param, htons(asoc->peer.port), 0))
|
||||
return SCTP_ERROR_DNS_FAILED;
|
||||
|
||||
/* ADDIP 4.2.1 This parameter MUST NOT contain a broadcast
|
||||
* or multicast address.
|
||||
@ -3331,7 +3333,8 @@ static void sctp_asconf_param_success(struct sctp_association *asoc,
|
||||
|
||||
/* We have checked the packet before, so we do not check again. */
|
||||
af = sctp_get_af_specific(param_type2af(addr_param->p.type));
|
||||
af->from_addr_param(&addr, addr_param, htons(bp->port), 0);
|
||||
if (!af->from_addr_param(&addr, addr_param, htons(bp->port), 0))
|
||||
return;
|
||||
|
||||
switch (asconf_param->param_hdr.type) {
|
||||
case SCTP_PARAM_ADD_IP:
|
||||
|
Loading…
Reference in New Issue
Block a user