Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Sasha Levin <Alexander.Levin@microsoft.com>
To:     "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "stable@vger.kernel.org" <stable@vger.kernel.org>
CC:     Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>,
        "David S . Miller" <davem@davemloft.net>,
        Sasha Levin <Alexander.Levin@microsoft.com>
Subject: [PATCH AUTOSEL for 4.14 105/110] sctp: add a ceiling to optlen in
 some sockopts
Thread-Topic: [PATCH AUTOSEL for 4.14 105/110] sctp: add a ceiling to optlen
 in some sockopts
Thread-Index: AQHTnRkG5B4xDnB9Vk+c5dT0DTDqJA==
Date:   Sat, 3 Feb 2018 18:01:33 +0000
Message-ID: <20180203180015.29073-105-alexander.levin@microsoft.com>
References: <20180203180015.29073-1-alexander.levin@microsoft.com>
In-Reply-To: <20180203180015.29073-1-alexander.levin@microsoft.com>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: microsoft.com does not designate
 permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 389e1540-277e-4c5c-9fc4-08d56b3058c7
X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Feb 2018 18:01:33.7846
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR2101MB0993
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>

[ Upstream commit 5960cefab9df76600a1a7d4ff592c59e14616e88 ]

Hangbin Liu reported that some sockopt calls could cause the kernel to log
a warning on memory allocation failure if the user supplied a large optlen
value. That is because some of them called memdup_user() without a ceiling
on optlen, allowing it to try to allocate really large buffers.

This patch adds a ceiling by limiting optlen to the maximum allowed that
would still make sense for these sockopt.

Reported-by: Hangbin Liu <haliu@redhat.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
 net/sctp/socket.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 1c08d86efe94..978fc7d1cf53 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3485,6 +3485,8 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk=
,
=20
 	if (optlen < sizeof(struct sctp_hmacalgo))
 		return -EINVAL;
+	optlen =3D min_t(unsigned int, optlen, sizeof(struct sctp_hmacalgo) +
+					     SCTP_AUTH_NUM_HMACS * sizeof(u16));
=20
 	hmacs =3D memdup_user(optval, optlen);
 	if (IS_ERR(hmacs))
@@ -3523,6 +3525,11 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
=20
 	if (optlen <=3D sizeof(struct sctp_authkey))
 		return -EINVAL;
+	/* authkey->sca_keylength is u16, so optlen can't be bigger than
+	 * this.
+	 */
+	optlen =3D min_t(unsigned int, optlen, USHRT_MAX +
+					     sizeof(struct sctp_authkey));
=20
 	authkey =3D memdup_user(optval, optlen);
 	if (IS_ERR(authkey))
@@ -3880,6 +3887,9 @@ static int sctp_setsockopt_reset_streams(struct sock =
*sk,
=20
 	if (optlen < sizeof(*params))
 		return -EINVAL;
+	/* srs_number_streams is u16, so optlen can't be bigger than this. */
+	optlen =3D min_t(unsigned int, optlen, USHRT_MAX +
+					     sizeof(__u16) * sizeof(*params));
=20
 	params =3D memdup_user(optval, optlen);
 	if (IS_ERR(params))
--=20
2.11.0