sctp: add param size validation for SCTP_PARAM_SET_PRIMARY
authorMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Mon, 28 Jun 2021 19:13:44 +0000 (16:13 -0300)
committerPDO SCM Team <hudsoncm@motorola.com>
Tue, 8 Mar 2022 06:30:43 +0000 (00:30 -0600)
commit27af556bdf89836eac1ba0dc7d019ae91d7defa0
treeb55c9995ad83cc7aa50acfaa8998f59cef691b50
parente1cc1a6d3078c27319164acdc2c0a116c6dcc072
sctp: add param size validation for SCTP_PARAM_SET_PRIMARY

commit ef6c8d6ccf0c1dccdda092ebe8782777cd7803c9 upstream.

When SCTP handles an INIT chunk, it calls for example:
sctp_sf_do_5_1B_init
  sctp_verify_init
    sctp_verify_param
  sctp_process_init
    sctp_process_param
      handling of SCTP_PARAM_SET_PRIMARY

sctp_verify_init() wasn't doing proper size validation and neither the
later handling, allowing it to work over the chunk itself, possibly being
uninitialized memory.

Mot-CRs-fixed: (CR)
CVE-Fixed: CVE-2021-3655
Bug: 197154735

Change-Id: I7435ddba396c7f1efce141e6209db280bffbb6ea
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Gajjala Chakradhar <gajjalac@motorola.com>
Reviewed-on: https://gerrit.mot.com/2197704
SME-Granted: SME Approvals Granted
SLTApproved: Slta Waiver
Tested-by: Jira Key
Reviewed-by: Xiangpo Zhao <zhaoxp3@motorola.com>
Submit-Approved: Jira Key
(cherry picked from commit 5fa7f599b8918a37f65927c9cfe40c9653fe28ee)
net/sctp/sm_make_chunk.c