Re: [netfilter-core] Re: [lockup] 2.6.17-rc3: netfilter/sctp: lockup in sctp_new(), do_basic_checks()

[Patrick McHardy <kaber@trash.net>]

Ingo Molnar wrote:
> thinking about it, what prevents the SCTP chunk's len field from being 
> zero, and thus causing an infinite loop in for_each_sctp_chunk()? The 
> patch below should fix that.
> 
> 	Ingo
> 
> ----
> From: Ingo Molnar <mingo@elte.hu>
> 
> fix infinite loop in the SCTP-netfilter code: check SCTP chunk size to 
> guarantee progress of for_each_sctp_chunk(). (all other uses of 
> for_each_sctp_chunk() are preceded by do_basic_checks(), so this fix 
> should be complete.)
> 
> Signed-off-by: Ingo Molnar <mingo@elte.hu>
> 
> Index: linux/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
> ===================================================================
> --- linux.orig/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
> +++ linux/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
> @@ -227,6 +227,15 @@ static int do_basic_checks(struct ip_con
>  	flag = 0;
>  
>  	for_each_sctp_chunk (skb, sch, _sch, offset, count) {
> +		unsigned int len = (htons(sch->length) + 3) & ~3;
> +
> +		/*
> +		 * Dont get into a loop with zero-sized or negative
> +		 * length values:
> +		 */
> +		if (!len || len >= skb->len)
> +			goto fail;
> +

I just came up with a similar fix :) I think I'm going to take
my own patch though because its IMO slightly nicer. Thanks anyway.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/