Re: [PATCH][V2] net: sctp: fix array overrun read on sctp_timer_tbl
From: Marcelo Ricardo Leitner
Date: Fri Jan 20 2017 - 11:58:03 EST
On Fri, Jan 20, 2017 at 11:31:17AM -0500, David Miller wrote:
> From: Colin King <colin.king@xxxxxxxxxxxxx>
> Date: Fri, 20 Jan 2017 13:45:42 +0000
>
> > From: Colin Ian King <colin.king@xxxxxxxxxxxxx>
> >
> > Table sctp_timer_tbl is missing a TIMEOUT_RECONF string so
> > add this in. Also compare timeout with the size of the array
> > sctp_timer_tbl rather than SCTP_EVENT_TIMEOUT_MAX. Also add
> > a build time check that SCTP_EVENT_TIMEOUT_MAX is correct
> > so we don't ever get this kind of mismatch between the table
> > and SCTP_EVENT_TIMEOUT_MAX in the future.
> >
> > Kudos to Marcel Ricardo Leitner for spotting the missing string
> > and suggesting the build time sanity check.
> >
> > Fixes CoverityScan CID#1397639 ("Out-of-bounds read")
> >
> > Signed-off-by: Colin Ian King <colin.king@xxxxxxxxxxxxx>
>
> Well, my bad... I reverted V1, that's fine.
>
> But this patch doesn't even compile.
>
> In file included from ./include/uapi/linux/stddef.h:1:0,
> from ./include/linux/stddef.h:4,
> from ./include/uapi/linux/posix_types.h:4,
> from ./include/uapi/linux/types.h:13,
> from ./include/linux/types.h:5,
> from ./include/net/sctp/sctp.h:58,
> from net/sctp/debug.c:41:
> net/sctp/debug.c: In function âsctp_tnameâ:
> ./include/linux/compiler.h:518:38: error: call to â__compiletime_assert_170â declared with attribute error: BUILD_BUG_ON failed: SCTP_EVENT_TIMEOUT_MAX + 1 != ARRAY_SIZE(sctp_timer_tbl)
> _compiletime_assert(condition, msg, __compiletime_assert_, __LINE__)
Seems you applied it on net tree, but commit that introduced the issue
(7b9438de0cd4) is still only on net-next.
I build-tested it here before acking, it worked, on top of
4567d686f5c6d955e57a3afa1741944c1e7f4033.
Colin, please respin the patch.. add the Fixes tag, fix the missing 'o'
in my name on the changelog :-) and tag the patch as net-next tree too.
Thanks,
Marcelo