Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 2 May 2023 13:48:15 +0200
From:   Simon Horman <simon.horman@corigine.com>
To:     Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Cc:     Neil Horman <nhorman@tuxdriver.com>,
        Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>,
        Xin Long <lucien.xin@gmail.com>,
        "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>,
        "linux-sctp@vger.kernel.org" <linux-sctp@vger.kernel.org>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "lvc-project@linuxtesting.org" <lvc-project@linuxtesting.org>
Subject: Re: [PATCH] sctp: fix a potential buffer overflow in
 sctp_sched_set_sched()
Message-ID: <ZFD4fw4FXWlAjNgK@corigine.com>
References: <20230502082622.2392659-1-Ilia.Gavrilov@infotecs.ru>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230502082622.2392659-1-Ilia.Gavrilov@infotecs.ru>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?FxndpVfVcc2duwZId/Lp1QxhY34m04BhWD58GoXEWHor8ttq13ild/jEBNMK?=
 =?us-ascii?Q?JE0Rfg2iHkzR0swyTstoHD7i5MAEdXiSCSqCMwJ97fle1FEixEkc3UgbuEwJ?=
 =?us-ascii?Q?AwGIGfnw2KvN4CmTjlTx0w/iX9lWTQqUzEvdgaicPqOMLmTEV9NjdFn7cWVm?=
 =?us-ascii?Q?R80SodtmxtYxqEPbnrL1flJaWyDR+O+B48pHUFIovxsdqFSov36R6Qn6ph0s?=
 =?us-ascii?Q?VSpH6PlKcpUzJmgro/aj8NgLVKUNb8bhEEYqMHAWwWhZn6rBpQTflzuCgTRK?=
 =?us-ascii?Q?Az+wXheNiGtLOz4ZBKuUeqRvcohaGqZpojRtLYxowuN2Pdd4T9pBIqMd2ip4?=
 =?us-ascii?Q?VwqF4UbKo3FFd8g2YQRWMn8GogN4LS1ylALIQg3/IlnH+/wMZvBxbPbjsDIt?=
 =?us-ascii?Q?RMqg4Cy/CkNZiXYMR7Y0a2mp3IQ6qp1SD+W/FqjCqF8lBRIQhvAVx9yT+VaI?=
 =?us-ascii?Q?LPx0BDroulafwo/DUgbzh6TjMMiO/5/NVS37pJKbw6H2uk6NXrgfjLo+ObTt?=
 =?us-ascii?Q?AgRDMWlWtJYRuxOzy9lyvfK5eahU6MuhrudOtAnuB65+P7TdOb4HwzoQFaeB?=
 =?us-ascii?Q?B30AuumpeG9xp9GO0Bh3Di8s7DyE2XIdSmhOXjs0/7Etm5Eq7COVdHDjUC1Z?=
 =?us-ascii?Q?BnLIudDXTUN5khswaKKjr/NZzfKiRC2Z4EiQxaB9p03rXOpyZlPFFY4hQ/+6?=
 =?us-ascii?Q?kXF6U/hyoUsjPdaXxIuXdCP1ELY5Mhy6AEJScAAXkvUlHTOmGk+RJ9JL5NeU?=
 =?us-ascii?Q?lRihtyHIzvjlJqW387gTWwW0BPxKR00ViIfTFn0d/lnm94+fX0JZ3jTooI4I?=
 =?us-ascii?Q?POZVYbRxQyIP0upuJ29+2FiShLU54euC5CqW6DTDHhMlTH0N1ZgnQAmJR9W1?=
 =?us-ascii?Q?LtZd/Ilz7o4WqMTIN6/euiz994BNuhVhNUI/mET5xtctiMvaWPYbWO8HgiO+?=
 =?us-ascii?Q?XgMNWA8pxHL/Atpu7EU6DhBySzwip/1Xmg2c0v9qLEZkngVbBSfzBiYfsDll?=
 =?us-ascii?Q?x2DRjoPG4jlQy813ziGlytsgW+pEMdmHiG28FZQFf6pEjclmlS//glNJ/ZHq?=
 =?us-ascii?Q?4tNrvR1xOJCWpvzOOIYeHlYGUH9CSrRBqea2SETEfqM1A8tsase9zzRJwfri?=
 =?us-ascii?Q?yuu2Ae1cBMdd09BBBqIeYZC4F7N14+z0gc1RsqO2iiXkQIiQcFh9aqIwVlUl?=
 =?us-ascii?Q?UwiP8a8/bqjYmQ/9p+zHxRqxUvx+qa9+i1dF5XKOIhp085XcY7J6//zhv3m7?=
 =?us-ascii?Q?nT5VOtpcNsQ5tFPmUT97fz3gs1/Ldc73n4AESQxi/bWSG/UTSZgMrEkADfIN?=
 =?us-ascii?Q?3j+veWoRuV/9i3b7pl0rBtVaXkQ5Ovxqyy4j5I4f/J8gyp6vUUDudSIRx/CK?=
 =?us-ascii?Q?ijh7tjj2kthT18BBo0tUHIE6Dt9+XG0bo66FEEaNCMMcCtGcqj/ErLCnmPpv?=
 =?us-ascii?Q?fcEl9b/JozbPQ6PafbiVyPMa/eTo94+8K55DF0CMvX6cBdI7RqjwgVrNEMPU?=
 =?us-ascii?Q?AI1CAPKR/hwbtRQPWGiuyIEFUZt1KmOnK66dWPnMH9IhWwKxaD9SE47reSCX?=
 =?us-ascii?Q?RI/intsq7C2LHnHFSjZfXHSB/c8AausUUhFylETfVGf6hOc6rF8360uU0wCK?=
 =?us-ascii?Q?2RVPJ2z8O2fa5dKGEqV8/MY8aw6HsJQ9PJsgjIRgxTGjrsMz5/rKCkhcdbcJ?=
 =?us-ascii?Q?pAZ5RQ=3D=3D?=
X-OriginatorOrg: corigine.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 8e724009-5166-415d-94ee-08db4b0320ef
X-MS-Exchange-CrossTenant-AuthSource: PH0PR13MB4842.namprd13.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 May 2023 11:48:21.3956
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: fe128f2c-073b-4c20-818e-7246a585940c
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: xRwT0B3Ub9kgVBc593uIWnNwt/HZ7QLyHTk10/TlAzUGJ2TWnFk1iKuuO3cR7KQbarXZR0g/agk41MDJT7TJ0bPpZzWIuHW11yqfbvV0C38=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR13MB3898
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, May 02, 2023 at 08:26:30AM +0000, Gavrilov Ilia wrote:
> The 'sched' index value must be checked before accessing an element
> of the 'sctp_sched_ops' array. Otherwise, it can lead to buffer overflow.
> 
> Note that it's harmless since the 'sched' parameter is checked before
> calling 'sctp_sched_set_sched'.
> 
> Found by InfoTeCS on behalf of Linux Verification Center
> (linuxtesting.org) with SVACE.
> 
> Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations")
> Signed-off-by: Ilia.Gavrilov <Ilia.Gavrilov@infotecs.ru>

Reviewed-by: Simon Horman <simon.horman@corigine.com>