回合主线补丁a2d859e3fc97 ("sctp: account stream padding length for reconf chunk")

sctp: account stream padding length for reconf chunk

sctp_make_strreset_req() makes repeated calls to sctp_addto_chunk()
which will automatically account for padding on each call. inreq and
outreq are already 4 bytes aligned, but the payload is not and doing
SCTP_PAD4(a + b) (which _sctp_make_chunk() did implicitly here) is
different from SCTP_PAD4(a) + SCTP_PAD4(b) and not enough. It led to
possible attempt to use more buffer than it was allocated and triggered
a BUG_ON.

Cc: Vlad Yasevich <vyasevich@gmail.com>
Cc: Neil Horman <nhorman@tuxdriver.com>
Cc: Greg KH <gregkh@linuxfoundation.org>
Fixes: cc16f00f6529 ("sctp: add support for generating stream reconf ssn reset request chunk")
Reported-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Link: https://lore.kernel.org/r/b97c1f8b0c7ff79ac4ed206fc2c49d3612e0850c.1634156849.git.mleitner@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

sctp存在一个会导致BUG_ON的问题，如下

在函数sctp_make_strreset_req()->sctp_make_reconf()->sctp_make_control()中，会先给chunk预留SCTP_PAD4(outlen + inlen)大小的缓冲区。然后再多次调用sctp_addto_chunk()填充缓冲区。填充一次，就做一次四字节对齐。代码中，分别依次填充sizeof(outreq)、stream_len、sizeof(inreq)、stream_len。其中sizeof(outreq)和sizeof(inreq)就是四字节对齐。stream_len不一定是四字节对齐。这样就会出现四次填充后，填充的长度大于分配的长度

```
3642 struct sctp_chunk *sctp_make_strreset_req(
3643                                         const struct sctp_association *asoc,
3644                                         __u16 stream_num, __be16 *stream_list,
3645                                         bool out, bool in)
3646 {
3647         __u16 stream_len = stream_num * sizeof(__u16);
3648         struct sctp_strreset_outreq outreq;
3649         struct sctp_strreset_inreq inreq;
3650         struct sctp_chunk *retval;
3651         __u16 outlen, inlen;
3652
3653         outlen = (sizeof(outreq) + stream_len) * out;
3654         inlen = (sizeof(inreq) + stream_len) * in;
3655
3656         retval = sctp_make_reconf(asoc, outlen + inlen); // 申请outlen+inlen长度的buf
3657         if (!retval)
3658                 return NULL;
3659
3660         if (outlen) {
3661                 outreq.param_hdr.type = SCTP_PARAM_RESET_OUT_REQUEST;
3662                 outreq.param_hdr.length = htons(outlen);
3663                 outreq.request_seq = htonl(asoc->strreset_outseq);
3664                 outreq.response_seq = htonl(asoc->strreset_inseq - 1);
3665                 outreq.send_reset_at_tsn = htonl(asoc->next_tsn - 1);
3666
3667                 sctp_addto_chunk(retval, sizeof(outreq), &outreq); //第一次填充，自动四字节对齐，不会占新的空间
3668
3669                 if (stream_len) {
3670                         sctp_addto_chunk(retval, stream_len, stream_list); //第二次填充，stream_list可能不是四字节对齐，填充后自动对齐后，会使用更多的buf
3671                 }
3672         }
3673
3674         if (inlen) {
3675                 inreq.param_hdr.type = SCTP_PARAM_RESET_IN_REQUEST;
3676                 inreq.param_hdr.length = htons(inlen);
3677                 inreq.request_seq = htonl(asoc->strreset_outseq + out);
3678
3679                 sctp_addto_chunk(retval, sizeof(inreq), &inreq); //第三次填充，自动四字节对齐，不会占新的空间
3680
3681                 if (stream_len) {
3682                         sctp_addto_chunk(retval, stream_len, stream_list); //第四次填充，stream_list可能不是四字节对齐，填充后自动对齐后，会使用更多的buf

3683                 }
3684         }
```

最终的效果就是：申请的内存大小是SCTP_PAD4(a+b)，但是使用的大小是SCTP_PAD4(a)+SCTP_PAD4(b)。而SCTP_PAD4(a)+SCTP_PAD4(b)是大于等于SCTP_PAD4(a+b)。这可能导致试图使用比分配的更多的缓冲区，会触发一个BUG_ON

需要回合社区补丁a2d859e3fc97 ("sctp: account stream padding length for reconf chunk")以解决问题

GVP openEuler/kernel

内容风险标识

评论 (1)

GVPopenEuler/kernel

内容风险标识