Dan Carpenter dee4506f06 sctp: potential read out of bounds in sctp_ulpevent_type_enabled() ... [ Upstream commit fa5f7b51fc ] This code causes a static checker warning because Smatch doesn't trust anything that comes from skb->data. I've reviewed this code and I do think skb->data can be controlled by the user here. The sctp_event_subscribe struct has 13 __u8 fields and we want to see if ours is non-zero. sn_type can be any value in the 0-USHRT_MAX range. We're subtracting SCTP_SN_TYPE_BASE which is 1 << 15 so we could read either before the start of the struct or after the end. This is a very old bug and it's surprising that it would go undetected for so long but my theory is that it just doesn't have a big impact so it would be hard to notice. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-10-21 17:09:01 +02:00
..
acpi	Merge branch 'acpi-pci'	2015-11-07 01:30:10 +01:00
asm-generic	percpu: make this_cpu_generic_read() atomic w.r.t. interrupts	2017-10-21 17:09:01 +02:00
clocksource
crypto	crypto: ahash - Fix EINPROGRESS notification callback	2017-04-21 09:30:06 +02:00
drm	drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces	2017-04-12 12:38:33 +02:00
dt-bindings	ARM: DT updates for v4.4	2015-11-10 15:06:26 -08:00
keys
kvm	KVM: arm/arm64: arch_timer: Preserve physical dist. active state on LR.active	2015-11-24 18:07:40 +01:00
linux	sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs	2017-10-12 11:27:35 +02:00
math-emu
media	videobuf2-core: Check user space planes array in dqbuf	2016-05-04 14:48:50 -07:00
memory
misc
net	sctp: potential read out of bounds in sctp_ulpevent_type_enabled()	2017-10-21 17:09:01 +02:00
pcmcia
ras
rdma	RDMA/core: Fix incorrect structure packing for booleans	2017-03-12 06:37:29 +01:00
rxrpc
scsi	scsi: libiscsi: add lock around task lists to fix list corruption regression	2017-03-26 12:13:19 +02:00
soc	ARM: at91: define LPDDR types	2017-03-12 06:37:24 +01:00
sound	ALSA: seq: Fix copy_from_user() call inside lock	2017-10-18 09:20:42 +02:00
target	iscsi-target: Fix iscsi_np reset hung task during parallel delete	2017-08-16 13:40:28 -07:00
trace	tracing: Add #undef to fix compile error	2017-03-18 19:09:57 +08:00
uapi	USB: fix out-of-bounds in usb_set_configuration	2017-10-12 11:27:33 +02:00
video	drm/imx: Match imx-ipuv3-crtc components using device node in platform data	2016-06-07 18:14:37 -07:00
xen	fix xen_swiotlb_dma_mmap prototype	2017-10-05 09:41:48 +02:00
Kbuild