提交 5e739d17 编写于 作者: V Vlad Yasevich 提交者: David S. Miller

sctp: fix potential panics in the SCTP-AUTH API.

All of the SCTP-AUTH socket options could cause a panic
if the extension is disabled and the API is envoked.

Additionally, there were some additional assumptions that
certain pointers would always be valid which may not
always be the case.

This patch hardens the API and address all of the crash
scenarios.
Signed-off-by: NVlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 6a55617e
...@@ -103,6 +103,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep, ...@@ -103,6 +103,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
/* Initialize the CHUNKS parameter */ /* Initialize the CHUNKS parameter */
auth_chunks->param_hdr.type = SCTP_PARAM_CHUNKS; auth_chunks->param_hdr.type = SCTP_PARAM_CHUNKS;
auth_chunks->param_hdr.length = htons(sizeof(sctp_paramhdr_t));
/* If the Add-IP functionality is enabled, we must /* If the Add-IP functionality is enabled, we must
* authenticate, ASCONF and ASCONF-ACK chunks * authenticate, ASCONF and ASCONF-ACK chunks
...@@ -110,8 +111,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep, ...@@ -110,8 +111,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
if (sctp_addip_enable) { if (sctp_addip_enable) {
auth_chunks->chunks[0] = SCTP_CID_ASCONF; auth_chunks->chunks[0] = SCTP_CID_ASCONF;
auth_chunks->chunks[1] = SCTP_CID_ASCONF_ACK; auth_chunks->chunks[1] = SCTP_CID_ASCONF_ACK;
auth_chunks->param_hdr.length = auth_chunks->param_hdr.length += htons(2);
htons(sizeof(sctp_paramhdr_t) + 2);
} }
} }
......
...@@ -3055,6 +3055,9 @@ static int sctp_setsockopt_auth_chunk(struct sock *sk, ...@@ -3055,6 +3055,9 @@ static int sctp_setsockopt_auth_chunk(struct sock *sk,
{ {
struct sctp_authchunk val; struct sctp_authchunk val;
if (!sctp_auth_enable)
return -EACCES;
if (optlen != sizeof(struct sctp_authchunk)) if (optlen != sizeof(struct sctp_authchunk))
return -EINVAL; return -EINVAL;
if (copy_from_user(&val, optval, optlen)) if (copy_from_user(&val, optval, optlen))
...@@ -3085,6 +3088,9 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk, ...@@ -3085,6 +3088,9 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
struct sctp_hmacalgo *hmacs; struct sctp_hmacalgo *hmacs;
int err; int err;
if (!sctp_auth_enable)
return -EACCES;
if (optlen < sizeof(struct sctp_hmacalgo)) if (optlen < sizeof(struct sctp_hmacalgo))
return -EINVAL; return -EINVAL;
...@@ -3123,6 +3129,9 @@ static int sctp_setsockopt_auth_key(struct sock *sk, ...@@ -3123,6 +3129,9 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
struct sctp_association *asoc; struct sctp_association *asoc;
int ret; int ret;
if (!sctp_auth_enable)
return -EACCES;
if (optlen <= sizeof(struct sctp_authkey)) if (optlen <= sizeof(struct sctp_authkey))
return -EINVAL; return -EINVAL;
...@@ -3160,6 +3169,9 @@ static int sctp_setsockopt_active_key(struct sock *sk, ...@@ -3160,6 +3169,9 @@ static int sctp_setsockopt_active_key(struct sock *sk,
struct sctp_authkeyid val; struct sctp_authkeyid val;
struct sctp_association *asoc; struct sctp_association *asoc;
if (!sctp_auth_enable)
return -EACCES;
if (optlen != sizeof(struct sctp_authkeyid)) if (optlen != sizeof(struct sctp_authkeyid))
return -EINVAL; return -EINVAL;
if (copy_from_user(&val, optval, optlen)) if (copy_from_user(&val, optval, optlen))
...@@ -3185,6 +3197,9 @@ static int sctp_setsockopt_del_key(struct sock *sk, ...@@ -3185,6 +3197,9 @@ static int sctp_setsockopt_del_key(struct sock *sk,
struct sctp_authkeyid val; struct sctp_authkeyid val;
struct sctp_association *asoc; struct sctp_association *asoc;
if (!sctp_auth_enable)
return -EACCES;
if (optlen != sizeof(struct sctp_authkeyid)) if (optlen != sizeof(struct sctp_authkeyid))
return -EINVAL; return -EINVAL;
if (copy_from_user(&val, optval, optlen)) if (copy_from_user(&val, optval, optlen))
...@@ -5197,19 +5212,29 @@ static int sctp_getsockopt_maxburst(struct sock *sk, int len, ...@@ -5197,19 +5212,29 @@ static int sctp_getsockopt_maxburst(struct sock *sk, int len,
static int sctp_getsockopt_hmac_ident(struct sock *sk, int len, static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
char __user *optval, int __user *optlen) char __user *optval, int __user *optlen)
{ {
struct sctp_hmacalgo __user *p = (void __user *)optval;
struct sctp_hmac_algo_param *hmacs; struct sctp_hmac_algo_param *hmacs;
__u16 param_len; __u16 data_len = 0;
u32 num_idents;
if (!sctp_auth_enable)
return -EACCES;
hmacs = sctp_sk(sk)->ep->auth_hmacs_list; hmacs = sctp_sk(sk)->ep->auth_hmacs_list;
param_len = ntohs(hmacs->param_hdr.length); data_len = ntohs(hmacs->param_hdr.length) - sizeof(sctp_paramhdr_t);
if (len < param_len) if (len < sizeof(struct sctp_hmacalgo) + data_len)
return -EINVAL; return -EINVAL;
len = sizeof(struct sctp_hmacalgo) + data_len;
num_idents = data_len / sizeof(u16);
if (put_user(len, optlen)) if (put_user(len, optlen))
return -EFAULT; return -EFAULT;
if (copy_to_user(optval, hmacs->hmac_ids, len)) if (put_user(num_idents, &p->shmac_num_idents))
return -EFAULT;
if (copy_to_user(p->shmac_idents, hmacs->hmac_ids, data_len))
return -EFAULT; return -EFAULT;
return 0; return 0;
} }
...@@ -5219,6 +5244,9 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len, ...@@ -5219,6 +5244,9 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
struct sctp_authkeyid val; struct sctp_authkeyid val;
struct sctp_association *asoc; struct sctp_association *asoc;
if (!sctp_auth_enable)
return -EACCES;
if (len < sizeof(struct sctp_authkeyid)) if (len < sizeof(struct sctp_authkeyid))
return -EINVAL; return -EINVAL;
if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid))) if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid)))
...@@ -5233,6 +5261,12 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len, ...@@ -5233,6 +5261,12 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
else else
val.scact_keynumber = sctp_sk(sk)->ep->active_key_id; val.scact_keynumber = sctp_sk(sk)->ep->active_key_id;
len = sizeof(struct sctp_authkeyid);
if (put_user(len, optlen))
return -EFAULT;
if (copy_to_user(optval, &val, len))
return -EFAULT;
return 0; return 0;
} }
...@@ -5243,13 +5277,16 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len, ...@@ -5243,13 +5277,16 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
struct sctp_authchunks val; struct sctp_authchunks val;
struct sctp_association *asoc; struct sctp_association *asoc;
struct sctp_chunks_param *ch; struct sctp_chunks_param *ch;
u32 num_chunks; u32 num_chunks = 0;
char __user *to; char __user *to;
if (len <= sizeof(struct sctp_authchunks)) if (!sctp_auth_enable)
return -EACCES;
if (len < sizeof(struct sctp_authchunks))
return -EINVAL; return -EINVAL;
if (copy_from_user(&val, p, sizeof(struct sctp_authchunks))) if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
return -EFAULT; return -EFAULT;
to = p->gauth_chunks; to = p->gauth_chunks;
...@@ -5258,20 +5295,21 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len, ...@@ -5258,20 +5295,21 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
return -EINVAL; return -EINVAL;
ch = asoc->peer.peer_chunks; ch = asoc->peer.peer_chunks;
if (!ch)
goto num;
/* See if the user provided enough room for all the data */ /* See if the user provided enough room for all the data */
num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t); num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
if (len < num_chunks) if (len < num_chunks)
return -EINVAL; return -EINVAL;
len = num_chunks; if (copy_to_user(to, ch->chunks, num_chunks))
if (put_user(len, optlen))
return -EFAULT; return -EFAULT;
num:
len = sizeof(struct sctp_authchunks) + num_chunks;
if (put_user(len, optlen)) return -EFAULT;
if (put_user(num_chunks, &p->gauth_number_of_chunks)) if (put_user(num_chunks, &p->gauth_number_of_chunks))
return -EFAULT; return -EFAULT;
if (copy_to_user(to, ch->chunks, len))
return -EFAULT;
return 0; return 0;
} }
...@@ -5282,13 +5320,16 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len, ...@@ -5282,13 +5320,16 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
struct sctp_authchunks val; struct sctp_authchunks val;
struct sctp_association *asoc; struct sctp_association *asoc;
struct sctp_chunks_param *ch; struct sctp_chunks_param *ch;
u32 num_chunks; u32 num_chunks = 0;
char __user *to; char __user *to;
if (len <= sizeof(struct sctp_authchunks)) if (!sctp_auth_enable)
return -EACCES;
if (len < sizeof(struct sctp_authchunks))
return -EINVAL; return -EINVAL;
if (copy_from_user(&val, p, sizeof(struct sctp_authchunks))) if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
return -EFAULT; return -EFAULT;
to = p->gauth_chunks; to = p->gauth_chunks;
...@@ -5301,17 +5342,21 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len, ...@@ -5301,17 +5342,21 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
else else
ch = sctp_sk(sk)->ep->auth_chunk_list; ch = sctp_sk(sk)->ep->auth_chunk_list;
if (!ch)
goto num;
num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t); num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
if (len < num_chunks) if (len < sizeof(struct sctp_authchunks) + num_chunks)
return -EINVAL; return -EINVAL;
len = num_chunks; if (copy_to_user(to, ch->chunks, num_chunks))
return -EFAULT;
num:
len = sizeof(struct sctp_authchunks) + num_chunks;
if (put_user(len, optlen)) if (put_user(len, optlen))
return -EFAULT; return -EFAULT;
if (put_user(num_chunks, &p->gauth_number_of_chunks)) if (put_user(num_chunks, &p->gauth_number_of_chunks))
return -EFAULT; return -EFAULT;
if (copy_to_user(to, ch->chunks, len))
return -EFAULT;
return 0; return 0;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册