From owner-dev-commits-src-branches@freebsd.org Sun Jun 6 23:28:50 2021 Return-Path: Delivered-To: dev-commits-src-branches@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id B623A641409; Sun, 6 Jun 2021 23:28:50 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Fyt424MXfz4kXf; Sun, 6 Jun 2021 23:28:50 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 7E07843E0; Sun, 6 Jun 2021 23:28:50 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 156NSoFp065235; Sun, 6 Jun 2021 23:28:50 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 156NSojN065234; Sun, 6 Jun 2021 23:28:50 GMT (envelope-from git) Date: Sun, 6 Jun 2021 23:28:50 GMT Message-Id: <202106062328.156NSojN065234@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Michael Tuexen Subject: git: f7b539eb6d83 - stable/13 - sctp: improve handling of illegal packets containing INIT chunks MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: tuexen X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: f7b539eb6d8331daefbb9faa01973b76923cb44d Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-branches@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commits to the stable branches of the FreeBSD src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 Jun 2021 23:28:50 -0000 The branch stable/13 has been updated by tuexen: URL: https://cgit.FreeBSD.org/src/commit/?id=f7b539eb6d8331daefbb9faa01973b76923cb44d commit f7b539eb6d8331daefbb9faa01973b76923cb44d Author: Michael Tuexen AuthorDate: 2021-04-26 08:38:05 +0000 Commit: Michael Tuexen CommitDate: 2021-06-02 21:40:11 +0000 sctp: improve handling of illegal packets containing INIT chunks Stop further processing of a packet when detecting that it contains an INIT chunk, which is too small or is not the only chunk in the packet. Still allow to finish the processing of chunks before the INIT chunk. Thanks to Antoly Korniltsev and Taylor Brandstetter for reporting an issue with the userland stack, which made me aware of this issue. (cherry picked from commit c70d1ef15db0d994eff4a2c4d9feabdc46bff1c6) --- sys/netinet/sctp_input.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/sys/netinet/sctp_input.c b/sys/netinet/sctp_input.c index 5b4c3152da0d..c70358f0af07 100644 --- a/sys/netinet/sctp_input.c +++ b/sys/netinet/sctp_input.c @@ -4611,10 +4611,7 @@ process_control_chunks: chunk_buf); if (ch == NULL) { *offset = length; - if (stcb != NULL) { - SCTP_TCB_UNLOCK(stcb); - } - return (NULL); + return (stcb); } num_chunks++; @@ -4648,12 +4645,12 @@ process_control_chunks: /* The INIT chunk must be the only chunk. */ if ((num_chunks > 1) || (length - *offset > (int)SCTP_SIZE32(chk_length))) { - /* RFC 4960 requires that no ABORT is sent */ + /* + * RFC 4960bis requires stopping the + * processing of the packet. + */ *offset = length; - if (stcb != NULL) { - SCTP_TCB_UNLOCK(stcb); - } - return (NULL); + return (stcb); } /* Honor our resource limit. */ if (chk_length > SCTP_LARGEST_INIT_ACCEPTED) {