linux/net/sctp
Daniel Borkmann 88362ad8f9 net: sctp: fix smatch warning in sctp_send_asconf_del_ip
This was originally reported in [1] and posted by Neil Horman [2], he said:

  Fix up a missed null pointer check in the asconf code. If we don't find
  a local address, but we pass in an address length of more than 1, we may
  dereference a NULL laddr pointer. Currently this can't happen, as the only
  users of the function pass in the value 1 as the addrcnt parameter, but
  its not hot path, and it doesn't hurt to check for NULL should that ever
  be the case.

The callpath from sctp_asconf_mgmt() looks okay. But this could be triggered
from sctp_setsockopt_bindx() call with SCTP_BINDX_REM_ADDR and addrcnt > 1
while passing all possible addresses from the bind list to SCTP_BINDX_REM_ADDR
so that we do *not* find a single address in the association's bind address
list that is not in the packed array of addresses. If this happens when we
have an established association with ASCONF-capable peers, then we could get
a NULL pointer dereference as we only check for laddr == NULL && addrcnt == 1
and call later sctp_make_asconf_update_ip() with NULL laddr.

BUT: this actually won't happen as sctp_bindx_rem() will catch such a case
and return with an error earlier. As this is incredably unintuitive and error
prone, add a check to catch at least future bugs here. As Neil says, its not
hot path. Introduced by 8a07eb0a5 ("sctp: Add ASCONF operation on the
single-homed host").

 [1] http://www.spinics.net/lists/linux-sctp/msg02132.html
 [2] http://www.spinics.net/lists/linux-sctp/msg02133.html

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Michio Honda <micchie@sfc.wide.ad.jp>
Acked-By: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-09-11 16:10:00 -04:00
..
associola.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-08-16 15:37:26 -07:00
auth.c net: sctp: trivial: update bug report in header comment 2013-08-09 11:33:02 -07:00
bind_addr.c net: sctp: trivial: update bug report in header comment 2013-08-09 11:33:02 -07:00
chunk.c net: sctp: Fix data chunk fragmentation for MTU values which are not multiple of 4 2013-09-04 13:20:27 -04:00
command.c net: sctp: trivial: update bug report in header comment 2013-08-09 11:33:02 -07:00
debug.c net: sctp: trivial: update bug report in header comment 2013-08-09 11:33:02 -07:00
endpointola.c net: sctp: trivial: update bug report in header comment 2013-08-09 11:33:02 -07:00
input.c Revert "net: sctp: convert sctp_checksum_disable module param into sctp sysctl" 2013-08-09 13:09:41 -07:00
inqueue.c net: sctp: trivial: update bug report in header comment 2013-08-09 11:33:02 -07:00
ipv6.c net: sctp: trivial: update bug report in header comment 2013-08-09 11:33:02 -07:00
Kconfig net: sctp: get rid of SCTP_DBG_TSNS entirely 2013-07-02 00:08:03 -07:00
Makefile sctp: implement sctp association probing module 2010-04-30 22:41:09 -04:00
objcnt.c net: sctp: trivial: update bug report in header comment 2013-08-09 11:33:02 -07:00
output.c Revert "net: sctp: convert sctp_checksum_disable module param into sctp sysctl" 2013-08-09 13:09:41 -07:00
outqueue.c net: sctp: trivial: update bug report in header comment 2013-08-09 11:33:02 -07:00
primitive.c net: sctp: trivial: update bug report in header comment 2013-08-09 11:33:02 -07:00
probe.c net: sctp: probe: allow more advanced ingress filtering by mark 2013-09-03 21:44:11 -04:00
proc.c net: proc_fs: trivial: print UIDs as unsigned int 2013-08-15 14:37:46 -07:00
protocol.c Revert "net: sctp: convert sctp_checksum_disable module param into sctp sysctl" 2013-08-09 13:09:41 -07:00
sm_make_chunk.c net: sctp: sctp_verify_init: clean up mandatory checks and add comment 2013-08-29 15:54:48 -04:00
sm_sideeffect.c net: sctp: trivial: update bug report in header comment 2013-08-09 11:33:02 -07:00
sm_statefuns.c net: sctp: trivial: update bug report in header comment 2013-08-09 11:33:02 -07:00
sm_statetable.c net: sctp: trivial: update bug report in header comment 2013-08-09 11:33:02 -07:00
socket.c net: sctp: fix smatch warning in sctp_send_asconf_del_ip 2013-09-11 16:10:00 -04:00
ssnmap.c net: sctp: trivial: update bug report in header comment 2013-08-09 11:33:02 -07:00
sysctl.c Revert "net: sctp: convert sctp_checksum_disable module param into sctp sysctl" 2013-08-09 13:09:41 -07:00
transport.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-08-16 15:37:26 -07:00
tsnmap.c net: sctp: trivial: update bug report in header comment 2013-08-09 11:33:02 -07:00
ulpevent.c net: sctp: trivial: update bug report in header comment 2013-08-09 11:33:02 -07:00
ulpqueue.c net: sctp: trivial: update bug report in header comment 2013-08-09 11:33:02 -07:00