diff options
| author |   Xin Long <lucien.xin@gmail.com> | 2018-10-29 23:13:11 +0800 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2018-10-29 20:50:41 -0700 |
| commit | 713358369382cebf92f6e98ce2005f94e7344931 (patch) | |
| tree | 6c8de4c6dba99bc5b78eefa807eb047cff2505ff /net/core/rtnetlink.c | |
| parent | sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer (diff) | |
| download | linux-dev-713358369382cebf92f6e98ce2005f94e7344931.tar.xz linux-dev-713358369382cebf92f6e98ce2005f94e7344931.zip | |
sctp: check policy more carefully when getting pr status
When getting pr_assocstatus and pr_streamstatus by sctp_getsockopt,
it doesn't correctly process the case when policy is set with
SCTP_PR_SCTP_ALL | SCTP_PR_SCTP_MASK. It even causes a
slab-out-of-bounds in sctp_getsockopt_pr_streamstatus().
This patch fixes it by return -EINVAL for this case.
Fixes: 0ac1077e3a54 ("sctp: get pr_assoc and pr_stream all status with SCTP_PR_SCTP_ALL")
Reported-by: syzbot+5da0d0a72a9e7d791748@syzkaller.appspotmail.com
Suggested-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core/rtnetlink.c')
0 files changed, 0 insertions, 0 deletions