Date: Tue, 22 Feb 2022 23:57:47 GMT From: Michael Tuexen <tuexen@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 0f63c2d187c4 - stable/13 - sctp: check that the computed frag point is a multiple of 4 Message-ID: <202202222357.21MNvlCn051802@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/13 has been updated by tuexen: URL: https://cgit.FreeBSD.org/src/commit/?id=0f63c2d187c4b67cdeaa0d4cfdae88db48106bcb commit 0f63c2d187c4b67cdeaa0d4cfdae88db48106bcb Author: Michael Tuexen <tuexen@FreeBSD.org> AuthorDate: 2021-12-28 08:40:52 +0000 Commit: Michael Tuexen <tuexen@FreeBSD.org> CommitDate: 2022-02-22 23:56:17 +0000 sctp: check that the computed frag point is a multiple of 4 Reported by: syzbot+5da189fc1fe80b31f5bd@syzkaller.appspotmail.com (cherry picked from commit ca0dd19f09335496390829851862c894f89a87f9) --- sys/netinet/sctp_output.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/sys/netinet/sctp_output.c b/sys/netinet/sctp_output.c index 598831220033..8b4a891c23aa 100644 --- a/sys/netinet/sctp_output.c +++ b/sys/netinet/sctp_output.c @@ -6246,13 +6246,12 @@ sctp_get_frag_point(struct sctp_tcb *stcb) if (asoc->smallest_mtu % 4) { overhead += (asoc->smallest_mtu % 4); } - KASSERT(overhead % 4 == 0, - ("overhead (%u) not a multiple of 4", overhead)); KASSERT(asoc->smallest_mtu > overhead, ("Association MTU (%u) too small for overhead (%u)", asoc->smallest_mtu, overhead)); - frag_point = asoc->smallest_mtu - overhead; + KASSERT(frag_point % 4 == 0, + ("frag_point (%u) not a multiple of 4", frag_point)); /* Honor MAXSEG socket option. */ if ((asoc->sctp_frag_point > 0) && (asoc->sctp_frag_point < frag_point)) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202202222357.21MNvlCn051802>