sctp: validate from_addr_param return
authorMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Mon, 28 Jun 2021 19:13:41 +0000 (16:13 -0300)
committerPDO SCM Team <hudsoncm@motorola.com>
Tue, 8 Mar 2022 06:30:13 +0000 (00:30 -0600)
commitcb2b9a739d2c987c4fce1d48d447f93486798612
tree29c82e92962934020cfeb90e3d900d36bd03f803
parent1e02baef7eccf89146fd0530e17314f24d42a289
sctp: validate from_addr_param return

[ Upstream commit 0c5dc070ff3d6246d22ddd931f23a6266249e3db ]

Ilja reported that, simply putting it, nothing was validating that
from_addr_param functions were operating on initialized memory. That is,
the parameter itself was being validated by sctp_walk_params, but it
doesn't check for types and their specific sizes and it could be a 0-length
one, causing from_addr_param to potentially work over the next parameter or
even uninitialized memory.

The fix here is to, in all calls to from_addr_param, check if enough space
is there for the wanted IP address type.

Mot-CRs-fixed: (CR)
CVE-Fixed: CVE-2021-3655
Bug: 197154735

Change-Id: Iac6ddb6a9de94e37660e286482a574824e4b6298
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Gajjala Chakradhar <gajjalac@motorola.com>
Reviewed-on: https://gerrit.mot.com/2197701
SME-Granted: SME Approvals Granted
SLTApproved: Slta Waiver
Tested-by: Jira Key
Reviewed-by: Xiangpo Zhao <zhaoxp3@motorola.com>
Submit-Approved: Jira Key
(cherry picked from commit ff64c7b4dcf2349ed9fc0ec5aa8865a3921f2fa4)
include/net/sctp/structs.h
net/sctp/bind_addr.c
net/sctp/input.c
net/sctp/ipv6.c
net/sctp/protocol.c
net/sctp/sm_make_chunk.c