Patch "sctp: fix the panic caused by route update" has been added to the 4.8-stable tree

This is a note to let you know that I've just added the patch titled

sctp: fix the panic caused by route update

to the 4.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
sctp-fix-the-panic-caused-by-route-update.patch
and it can be found in the queue-4.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Xin Long <[email protected]>
Date: Mon, 24 Oct 2016 01:01:09 +0800
Subject: sctp: fix the panic caused by route update

From: Xin Long <[email protected]>

[ Upstream commit ecc515d7238f2cffac839069d56dc271141defa0 ]

Commit 7303a1475008 ("sctp: identify chunks that need to be fragmented at IP level") made the chunk be fragmented at IP level in the next round if it's size exceed PMTU.

But there still is another case, PMTU can be updated if transport's dst expires and transport's pmtu_pending is set in sctp_packet_transmit. If the new PMTU is less than the chunk, the same issue with that commit can be triggered.

So we should drop this packet and let it retransmit in another round where it would be fragmented at IP level.

This patch is to fix it by checking the chunk size after PMTU may be updated and dropping this packet if it's size exceed PMTU.

---
 net/sctp/output.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

@@ -417,6 +417,7 @@ int sctp_packet_transmit(struct sctp_pac
 	__u8 has_data = 0;
 	int gso = 0;
 	int pktcount = 0;
+	int auth_len = 0;
 	struct dst_entry *dst;
 	unsigned char *auth = NULL;	/* pointer to auth in skb data */
 

@@ -505,7 +506,12 @@ int sctp_packet_transmit(struct sctp_pac
 			list_for_each_entry(chunk, &packet->chunk_list, list) {
 				int padded = WORD_ROUND(chunk->skb->len);
 
-				if (pkt_size + padded > tp->pathmtu)
+				if (chunk == packet->auth)
+					auth_len = padded;
+				else if (auth_len + padded + packet->overhead >
+					 tp->pathmtu)
+					goto nomem;
+				else if (pkt_size + padded > tp->pathmtu)
 					break;
 				pkt_size += padded;
 			}

Patches currently in stable-queue which might be from [email protected] are

queue-4.8/sctp-validate-chunk-len-before-actually-using-it.patch queue-4.8/sctp-fix-the-panic-caused-by-route-update.patch