lkml.org 
[lkml]   [2021]   [Nov]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.14 102/125] sctp: fix the processing for COOKIE_ECHO chunk
    Date
    From: Xin Long <lucien.xin@gmail.com>

    [ Upstream commit a64b341b8695e1c744dd972b39868371b4f68f83 ]

    1. In closed state: in sctp_sf_do_5_1D_ce():

    When asoc is NULL, making packet for abort will use chunk's vtag
    in sctp_ootb_pkt_new(). But when asoc exists, vtag from the chunk
    should be verified before using peer.i.init_tag to make packet
    for abort in sctp_ootb_pkt_new(), and just discard it if vtag is
    not correct.

    2. In the other states: in sctp_sf_do_5_2_4_dupcook():

    asoc always exists, but duplicate cookie_echo's vtag will be
    handled by sctp_tietags_compare() and then take actions, so before
    that we only verify the vtag for the abort sent for invalid chunk
    length.

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Xin Long <lucien.xin@gmail.com>
    Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/sctp/sm_statefuns.c | 14 ++++++++++----
    1 file changed, 10 insertions(+), 4 deletions(-)

    diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
    index 672e5308839b..96a069d725e9 100644
    --- a/net/sctp/sm_statefuns.c
    +++ b/net/sctp/sm_statefuns.c
    @@ -710,6 +710,9 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
    struct sock *sk;
    int error = 0;

    + if (asoc && !sctp_vtag_verify(chunk, asoc))
    + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    +
    /* If the packet is an OOTB packet which is temporarily on the
    * control endpoint, respond with an ABORT.
    */
    @@ -724,7 +727,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
    * in sctp_unpack_cookie().
    */
    if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
    - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
    + commands);

    /* If the endpoint is not listening or if the number of associations
    * on the TCP-style socket exceed the max backlog, respond with an
    @@ -2204,9 +2208,11 @@ enum sctp_disposition sctp_sf_do_5_2_4_dupcook(
    * enough for the chunk header. Cookie length verification is
    * done later.
    */
    - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
    - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
    - commands);
    + if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) {
    + if (!sctp_vtag_verify(chunk, asoc))
    + asoc = NULL;
    + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, commands);
    + }

    /* "Decode" the chunk. We have no optional parameters so we
    * are in good shape.
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-01 10:53    [W:4.185 / U:24.904 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site