Patch "sctp: validate chunk len before actually using it" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

sctp: validate chunk len before actually using it

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
sctp-validate-chunk-len-before-actually-using-it.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Marcelo Ricardo Leitner <[email protected]>
Date: Tue, 25 Oct 2016 14:27:39 -0200
Subject: sctp: validate chunk len before actually using it

From: Marcelo Ricardo Leitner <[email protected]>

[ Upstream commit bf911e985d6bbaa328c20c3e05f4eb03de11fdd6 ]

Andrey Konovalov reported that KASAN detected that SCTP was using a slab beyond the boundaries. It was caused because when handling out of the blue packets in function sctp_sf_ootb() it was checking the chunk len only after already processing the first chunk, validating only for the 2nd and subsequent ones.

The fix is to just move the check upwards so it's also validated for the 1st chunk.

---
 net/sctp/sm_statefuns.c |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

@@ -3426,6 +3426,12 @@ sctp_disposition_t sctp_sf_ootb(struct n
 			return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
 						  commands);
 
+		/* Report violation if chunk len overflows */
+		ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
+		if (ch_end > skb_tail_pointer(skb))
+			return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
+						  commands);
+
 		/* Now that we know we at least have a chunk header,
 		 * do things that are type appropriate.
 		 */

@@ -3457,12 +3463,6 @@ sctp_disposition_t sctp_sf_ootb(struct n
 			}
 		}
 
-		/* Report violation if chunk len overflows */
-		ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
-		if (ch_end > skb_tail_pointer(skb))
-			return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
-						  commands);
-
 		ch = (sctp_chunkhdr_t *) ch_end;
 	} while (ch_end < skb_tail_pointer(skb));
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/sctp-validate-chunk-len-before-actually-using-it.patch