sctp: fix ICMP processing if skb is non-linear
authorDavide Caratti <dcaratti@redhat.com>
Thu, 25 May 2017 17:14:56 +0000 (19:14 +0200)
committerDavid S. Miller <davem@davemloft.net>
Fri, 26 May 2017 18:40:46 +0000 (14:40 -0400)
sometimes ICMP replies to INIT chunks are ignored by the client, even if
the encapsulated SCTP headers match an open socket. This happens when the
ICMP packet is carried by a paged skb: use skb_header_pointer() to read
packet contents beyond the SCTP header, so that chunk header and initiate
tag are validated correctly.

v2:
- don't use skb_header_pointer() to read the transport header, since
  icmp_socket_deliver() already puts these 8 bytes in the linear area.
- change commit message to make specific reference to INIT chunks.

Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/sctp/input.c

index 0e06a27..ba9ad32 100644 (file)
@@ -473,15 +473,14 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
                             struct sctp_association **app,
                             struct sctp_transport **tpp)
 {
+       struct sctp_init_chunk *chunkhdr, _chunkhdr;
        union sctp_addr saddr;
        union sctp_addr daddr;
        struct sctp_af *af;
        struct sock *sk = NULL;
        struct sctp_association *asoc;
        struct sctp_transport *transport = NULL;
-       struct sctp_init_chunk *chunkhdr;
        __u32 vtag = ntohl(sctphdr->vtag);
-       int len = skb->len - ((void *)sctphdr - (void *)skb->data);
 
        *app = NULL; *tpp = NULL;
 
@@ -516,13 +515,16 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
         * discard the packet.
         */
        if (vtag == 0) {
-               chunkhdr = (void *)sctphdr + sizeof(struct sctphdr);
-               if (len < sizeof(struct sctphdr) + sizeof(sctp_chunkhdr_t)
-                         + sizeof(__be32) ||
+               /* chunk header + first 4 octects of init header */
+               chunkhdr = skb_header_pointer(skb, skb_transport_offset(skb) +
+                                             sizeof(struct sctphdr),
+                                             sizeof(struct sctp_chunkhdr) +
+                                             sizeof(__be32), &_chunkhdr);
+               if (!chunkhdr ||
                    chunkhdr->chunk_hdr.type != SCTP_CID_INIT ||
-                   ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag) {
+                   ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag)
                        goto out;
-               }
+
        } else if (vtag != asoc->c.peer_vtag) {
                goto out;
        }