Xin Long ef82bcfa67 sctp: use memdup_user instead of vmemdup_user ... In sctp_setsockopt_bindx()/__sctp_setsockopt_connectx(), it allocates memory with addrs_size which is passed from userspace. We used flag GFP_USER to put some more restrictions on it in Commit cacc062152 ("sctp: use GFP_USER for user-controlled kmalloc"). However, since Commit c981f254cc ("sctp: use vmemdup_user() rather than badly open-coding memdup_user()"), vmemdup_user() has been used, which doesn't check GFP_USER flag when goes to vmalloc_*(). So when addrs_size is a huge value, it could exhaust memory and even trigger oom killer. This patch is to use memdup_user() instead, in which GFP_USER would work to limit the memory allocation with a huge addrs_size. Note we can't fix it by limiting 'addrs_size', as there's no demand for it from RFC. Reported-by: syzbot+ec1b7575afef85a0e5ca@syzkaller.appspotmail.com Fixes: c981f254cc ("sctp: use vmemdup_user() rather than badly open-coding memdup_user()") Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2019-03-20 11:09:47 -07:00
..
associola.c	sctp: add SCTP_FUTURE_ASSOC for SCTP_PEER_ADDR_THLDS sockopt	2019-01-30 00:44:06 -08:00
auth.c	sctp: move up sctp_auth_init_hmacs() in sctp_endpoint_init()	2019-03-08 11:42:49 -08:00
bind_addr.c
chunk.c	sctp: chunk.c: correct format string for size_t in printk	2019-02-28 10:33:40 -08:00
debug.c
diag.c	inet_diag: fix reporting cgroup classid and fallback to priority	2019-02-12 13:35:57 -05:00
endpointola.c	sctp: move up sctp_auth_init_hmacs() in sctp_endpoint_init()	2019-03-08 11:42:49 -08:00
input.c
inqueue.c
ipv6.c	sctp: set flow sport from saddr only when it's 0	2019-01-24 18:13:57 -08:00
Kconfig
Makefile
objcnt.c
offload.c	sctp: call gso_reset_checksum when computing checksum in sctp_gso_segment	2019-02-13 19:31:43 -05:00
output.c
outqueue.c	sctp: add SCTP_FUTURE_ASOC and SCTP_CURRENT_ASSOC for SCTP_STREAM_SCHEDULER sockopt	2019-01-30 00:44:08 -08:00
primitive.c
proc.c
protocol.c	sctp: set flow sport from saddr only when it's 0	2019-01-24 18:13:57 -08:00
sm_make_chunk.c	sctp: set chunk transport correctly when it's a new asoc	2019-01-24 18:13:57 -08:00
sm_sideeffect.c
sm_statefuns.c
sm_statetable.c
socket.c	sctp: use memdup_user instead of vmemdup_user	2019-03-20 11:09:47 -07:00
stream_interleave.c	sctp: convert to genradix	2019-03-12 10:04:02 -07:00
stream_sched_prio.c
stream_sched_rr.c
stream_sched.c
stream.c	sctp: convert to genradix	2019-03-12 10:04:02 -07:00
sysctl.c
transport.c	sctp: don't compare hb_timer expire date before starting it	2019-02-22 11:11:54 -08:00
tsnmap.c
ulpevent.c
ulpqueue.c