• Xin Long's avatar
    sctp: trim optlen when it's a huge value in sctp_setsockopt · 2f3fdd8d
    Xin Long authored
    After commit ca84bd05 ("sctp: copy the optval from user space in
    sctp_setsockopt"), it does memory allocation in sctp_setsockopt with
    the optlen, and it would fail the allocation and return error if the
    optlen from user space is a huge value.
    
    This breaks some sockopts, like SCTP_HMAC_IDENT, SCTP_RESET_STREAMS and
    SCTP_AUTH_KEY, as when processing these sockopts before, optlen would
    be trimmed to a biggest value it needs when optlen is a huge value,
    instead of failing the allocation and returning error.
    
    This patch is to fix the allocation failure when it's a huge optlen from
    user space by trimming it to the biggest size sctp sockopt may need when
    necessary, and this biggest size is from sctp_setsockopt_reset_streams()
    for SCTP_RESET_STREAMS, which is bigger than those for SCTP_HMAC_IDENT
    and SCTP_AUTH_KEY.
    
    Fixes: ca84bd05 ("sctp: copy the optval from user space in sctp_setsockopt")
    Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    2f3fdd8d
socket.c 265 KB