lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 10 Jun 2014 14:27:07 +0800 From: Xufeng Zhang <xufengzhang.main@...il.com> To: Vlad Yasevich <vyasevich@...il.com>, Neil Horman <nhorman@...driver.com> Cc: linux-sctp <linux-sctp@...r.kernel.org>, netdev <netdev@...r.kernel.org>, linux-kernel <linux-kernel@...r.kernel.org>, xufeng zhang <xufeng.zhang@...driver.com> Subject: sctp bug: sk_ack_backlog wrap-around problem Hi Vlad and Neil, I found a sk_ack_backlog wrap-around problem during handling received COOKIE_ECHO. Consider the scenario: For a TCP-style socket, while processing the COOKIE_ECHO chunk in sctp_sf_do_5_1D_ce(), after it has passed a series of sanity check, a new association would be created in sctp_unpack_cookie(), but afterwards, some processing maybe failed, and sctp_association_free() will be called to free the previously allocated association, in sctp_association_free(), sk_ack_backlog value is decremented for this socket, since the initial value for sk_ack_backlog is 0, after the decrement, it will be 65535, a wrap-around problem happens, and if we want to establish new associations afterward in the same socket, ABORT would be triggered since sctp deem the accept queue as full. Do you have any idea to fix such kind of issue? Thanks a lot! Xufeng -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists