]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
sctp: Prevent TOCTOU out-of-bounds write
authorStefan Wiehler <stefan.wiehler@nokia.com>
Tue, 28 Oct 2025 16:12:27 +0000 (17:12 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 3 Dec 2025 11:45:15 +0000 (12:45 +0100)
commitb106a68df0650b694b254427cd9250c04500edd3
tree64652a26e65d0641098b20221d5bb598feac7531
parent5add5db8b1edd9ae73c5228773cfa2e9dd95e9e5
sctp: Prevent TOCTOU out-of-bounds write

[ Upstream commit 95aef86ab231f047bb8085c70666059b58f53c09 ]

For the following path not holding the sock lock,

  sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump()

make sure not to exceed bounds in case the address list has grown
between buffer allocation (time-of-check) and write (time-of-use).

Suggested-by: Kuniyuki Iwashima <kuniyu@google.com>
Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file")
Signed-off-by: Stefan Wiehler <stefan.wiehler@nokia.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20251028161506.3294376-3-stefan.wiehler@nokia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/sctp/diag.c