Xin Long 0ead60804b sctp: properly validate chunk size in sctp_sf_ootb() ... A size validation fix similar to that in Commit 50619dbf8d ("sctp: add size validation when walking chunks") is also required in sctp_sf_ootb() to address a crash reported by syzbot: BUG: KMSAN: uninit-value in sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712 sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712 sctp_do_sm+0x181/0x93d0 net/sctp/sm_sideeffect.c:1166 sctp_endpoint_bh_rcv+0xc38/0xf90 net/sctp/endpointola.c:407 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_rcv+0x3831/0x3b20 net/sctp/input.c:243 sctp4_rcv+0x42/0x50 net/sctp/protocol.c:1159 ip_protocol_deliver_rcu+0xb51/0x13d0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233 Reported-by: syzbot+f0cbb34d39392f2746ca@syzkaller.appspotmail.com Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Xin Long <lucien.xin@gmail.com> Link: https://patch.msgid.link/a29ebb6d8b9f8affd0f9abb296faafafe10c17d8.1730223981.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2024-11-03 11:03:23 -08:00
..
associola.c
auth.c
bind_addr.c
chunk.c
debug.c
diag.c
endpointola.c
input.c	sctp: Fix null-ptr-deref in reuseport_add_sock().	2024-08-02 16:25:06 -07:00
inqueue.c	net: sctp: fix skb leak in sctp_inq_free()	2024-02-15 07:34:52 -08:00
ipv6.c	ipv6: introduce dst_rt6_info() helper	2024-04-29 13:32:01 +01:00
Kconfig
Makefile
objcnt.c
offload.c
output.c
outqueue.c
primitive.c
proc.c
protocol.c	sctp: Unmask upper DSCP bits in sctp_v4_get_dst()	2024-09-09 14:14:53 +01:00
sm_make_chunk.c
sm_sideeffect.c
sm_statefuns.c	sctp: properly validate chunk size in sctp_sf_ootb()	2024-11-03 11:03:23 -08:00
sm_statetable.c
socket.c	sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start	2024-10-09 13:36:32 +01:00
stream_interleave.c
stream_sched_fc.c
stream_sched_prio.c
stream_sched_rr.c
stream_sched.c
stream.c
sysctl.c	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
transport.c
tsnmap.c
ulpevent.c
ulpqueue.c