Nikolay Kuratov 94b7ed0a48 net/sctp: Prevent autoclose integer overflow in sctp_association_init() ...

commit 4e86729d1f upstream.

While by default max_autoclose equals to INT_MAX / HZ, one may set
net.sctp.max_autoclose to UINT_MAX. There is code in
sctp_association_init() that can consequently trigger overflow.

Cc: stable@vger.kernel.org
Fixes: 9f70f46bd4 ("sctp: properly latch and use autoclose value from sock to association")
Signed-off-by: Nikolay Kuratov <kniv@yandex-team.ru>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20241219162114.2863827-1-kniv@yandex-team.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-01-09 13:23:37 +01:00

..

6lowpan

…

9p

9p/xen: fix release of IRQ

2024-12-14 19:44:41 +01:00

802

…

8021q

…

appletalk

…

atm

…

ax25

…

batman-adv

batman-adv: Do not let TT changes list grows indefinitely

2024-12-19 18:05:03 +01:00

bluetooth

Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()

2024-12-14 19:44:51 +01:00

bpf

…

bpfilter

…

bridge

netfilter: Replace zero-length array with flexible-array member

2025-01-09 13:23:35 +01:00

caif

…

can

net: af_can: do not leave a dangling sk pointer in can_create()

2024-12-14 19:44:51 +01:00

ceph

…

core

skb_expand_head() adjust skb->truesize incorrectly

2025-01-09 13:23:33 +01:00

dcb

…

dccp

dccp: Fix memory leak in dccp_feat_change_recv

2024-12-14 19:44:45 +01:00

decnet

…

dns_resolver

…

dsa

…

ethernet

…

hsr

…

ieee802154

net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()

2024-12-14 19:44:51 +01:00

ife

…

ipv4

netfilter: Replace zero-length array with flexible-array member

2025-01-09 13:23:35 +01:00

ipv6

ila: serialize calls to nf_register_net_hooks()

2025-01-09 13:23:35 +01:00

iucv

…

kcm

…

key

…

l2tp

genetlink: hold RCU in genlmsg_mcast()

2024-11-08 16:20:50 +01:00

l3mdev

…

lapb

…

llc

net: llc: reset skb->transport_header

2025-01-09 13:23:35 +01:00

mac80211

wifi: mac80211: wake the queues in case of failure in resume

2025-01-09 13:23:35 +01:00

mac802154

…

mpls

…

ncsi

…

netfilter

netfilter: Replace zero-length array with flexible-array member

2025-01-09 13:23:35 +01:00

netlabel

…

netlink

netlink: terminate outstanding dump on socket close

2024-12-14 19:44:18 +01:00

netrom

netrom: check buffer length before accessing it

2025-01-09 13:23:35 +01:00

nfc

…

nsh

…

openvswitch

…

packet

af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK

2025-01-09 13:23:35 +01:00

phonet

…

psample

…

qrtr

net: qrtr: Update packets cloning when broadcasting

2024-11-08 16:20:33 +01:00

rds

net:rds: Fix possible deadlock in rds_message_put

2024-09-04 13:15:03 +02:00

rfkill

net: rfkill: gpio: Add check for clk_enable()

2024-12-14 19:44:27 +01:00

rose

…

rxrpc

…

sched

net: sched: fix ordering of qlen adjustment

2025-01-09 13:23:26 +01:00

sctp

net/sctp: Prevent autoclose integer overflow in sctp_association_init()

2025-01-09 13:23:37 +01:00

smc

net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll

2025-01-09 13:23:27 +01:00

strparser

…

sunrpc

sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport

2024-12-14 19:44:42 +01:00

switchdev

…

tipc

tipc: fix NULL deref in cleanup_bearer()

2024-12-19 18:05:03 +01:00

tls

…

unix

af_unix: Remove put_pid()/put_cred() in copy_peercred().

2024-09-12 11:03:52 +02:00

vmw_vsock

vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans

2024-11-17 14:58:52 +01:00

wimax

…

wireless

genetlink: hold RCU in genlmsg_mcast()

2024-11-08 16:20:50 +01:00

x25

…

xdp

…

xfrm

xfrm: validate new SA's prefixlen using SA family when sel.family is unset

2024-11-08 16:20:52 +01:00

compat.c

…

Kconfig

…

Makefile

…

socket.c

…

sysctl_net.c

…