Fixes for 4.9

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-4.9/sctp-add-vtag-check-in-sctp_sf_violation.patch b/queue-4.9/sctp-add-vtag-check-in-sctp_sf_violation.patch
new file mode 100644 (file)
index 0000000..85ddf34
--- /dev/null
+++ b/queue-4.9/sctp-add-vtag-check-in-sctp_sf_violation.patch
@@ -0,0 +1,43 @@
+From 7e969dfce9b8b6d7ce50dcfb41ea42babe2a70ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Oct 2021 07:42:45 -0400
+Subject: sctp: add vtag check in sctp_sf_violation
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit aa0f697e45286a6b5f0ceca9418acf54b9099d99 ]
+
+sctp_sf_violation() is called when processing HEARTBEAT_ACK chunk
+in cookie_wait state, and some other places are also using it.
+
+The vtag in the chunk's sctphdr should be verified, otherwise, as
+later in chunk length check, it may send abort with the existent
+asoc's vtag, which can be exploited by one to cook a malicious
+chunk to terminate a SCTP asoc.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/sm_statefuns.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index c3d293dc8281..f71991520ad6 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -4333,6 +4333,9 @@ sctp_disposition_t sctp_sf_violation(struct net *net,
+ {
+       struct sctp_chunk *chunk = arg;
+ 
++      if (!sctp_vtag_verify(chunk, asoc))
++              return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
++
+       /* Make sure that the chunk has a valid length. */
+       if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t)))
+               return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
+-- 
+2.33.0
+

diff --git a/queue-4.9/sctp-use-init_tag-from-inithdr-for-abort-chunk.patch b/queue-4.9/sctp-use-init_tag-from-inithdr-for-abort-chunk.patch
new file mode 100644 (file)
index 0000000..1993443
--- /dev/null
+++ b/queue-4.9/sctp-use-init_tag-from-inithdr-for-abort-chunk.patch
@@ -0,0 +1,42 @@
+From e8b197c4ddfd1b973a3f558ab537e98a590e3491 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Oct 2021 07:42:41 -0400
+Subject: sctp: use init_tag from inithdr for ABORT chunk
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 4f7019c7eb33967eb87766e0e4602b5576873680 ]
+
+Currently Linux SCTP uses the verification tag of the existing SCTP
+asoc when failing to process and sending the packet with the ABORT
+chunk. This will result in the peer accepting the ABORT chunk and
+removing the SCTP asoc. One could exploit this to terminate a SCTP
+asoc.
+
+This patch is to fix it by always using the initiate tag of the
+received INIT chunk for the ABORT chunk to be sent.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/sm_statefuns.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 9045f6bcb34c..c3d293dc8281 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -6018,6 +6018,7 @@ static struct sctp_packet *sctp_ootb_pkt_new(struct net *net,
+                * yet.
+                */
+               switch (chunk->chunk_hdr->type) {
++              case SCTP_CID_INIT:
+               case SCTP_CID_INIT_ACK:
+               {
+                       sctp_initack_chunk_t *initack;
+-- 
+2.33.0
+

diff --git a/queue-4.9/series b/queue-4.9/series
index 97dc44a76fc885eaa2040dd62bfdbf7a9dc0ca6d..b7fd86fbcba3fb998c5893565d04788dbee8e8d0 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -16,3 +16,5 @@ regmap-fix-possible-double-free-in-regcache_rbtree_exit.patch
 net-batman-adv-fix-error-handling.patch
 nios2-make-nios2_dtb_source_bool-depend-on-compile_test.patch
 net-nxp-lpc_eth.c-avoid-hang-when-bringing-interface-down.patch
+sctp-use-init_tag-from-inithdr-for-abort-chunk.patch
+sctp-add-vtag-check-in-sctp_sf_violation.patch