1 files changed, 74 insertions, 22 deletions

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index dbb79adf8f3c..5ffb9dec1c3f 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3055,6 +3055,9 @@ static int sctp_setsockopt_auth_chunk(struct sock *sk,
 {
         struct sctp_authchunk val;
 
+        if (!sctp_auth_enable)
+                return -EACCES;
+
         if (optlen != sizeof(struct sctp_authchunk))
                 return -EINVAL;
         if (copy_from_user(&val, optval, optlen))
@@ -3083,8 +3086,12 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
                                     int optlen)
 {
         struct sctp_hmacalgo *hmacs;
+        u32 idents;
         int err;
 
+        if (!sctp_auth_enable)
+                return -EACCES;
+
         if (optlen < sizeof(struct sctp_hmacalgo))
                 return -EINVAL;
 
@@ -3097,8 +3104,9 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
                 goto out;
         }
 
-        if (hmacs->shmac_num_idents == 0 ||
-            hmacs->shmac_num_idents > SCTP_AUTH_NUM_HMACS) {
+        idents = hmacs->shmac_num_idents;
+        if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS ||
+            (idents * sizeof(u16)) > (optlen - sizeof(struct sctp_hmacalgo))) {
                 err = -EINVAL;
                 goto out;
         }
@@ -3123,6 +3131,9 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
         struct sctp_association *asoc;
         int ret;
 
+        if (!sctp_auth_enable)
+                return -EACCES;
+
         if (optlen <= sizeof(struct sctp_authkey))
                 return -EINVAL;
 
@@ -3135,6 +3146,11 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
                 goto out;
         }
 
+        if (authkey->sca_keylength > optlen - sizeof(struct sctp_authkey)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
         asoc = sctp_id2assoc(sk, authkey->sca_assoc_id);
         if (!asoc && authkey->sca_assoc_id && sctp_style(sk, UDP)) {
                 ret = -EINVAL;
@@ -3160,6 +3176,9 @@ static int sctp_setsockopt_active_key(struct sock *sk,
         struct sctp_authkeyid val;
         struct sctp_association *asoc;
 
+        if (!sctp_auth_enable)
+                return -EACCES;
+
         if (optlen != sizeof(struct sctp_authkeyid))
                 return -EINVAL;
         if (copy_from_user(&val, optval, optlen))
@@ -3185,6 +3204,9 @@ static int sctp_setsockopt_del_key(struct sock *sk,
         struct sctp_authkeyid val;
         struct sctp_association *asoc;
 
+        if (!sctp_auth_enable)
+                return -EACCES;
+
         if (optlen != sizeof(struct sctp_authkeyid))
                 return -EINVAL;
         if (copy_from_user(&val, optval, optlen))
@@ -5197,19 +5219,29 @@ static int sctp_getsockopt_maxburst(struct sock *sk, int len,
 static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
                                     char __user *optval, int __user *optlen)
 {
+        struct sctp_hmacalgo  __user *p = (void __user *)optval;
         struct sctp_hmac_algo_param *hmacs;
-        __u16 param_len;
+        __u16 data_len = 0;
+        u32 num_idents;
+
+        if (!sctp_auth_enable)
+                return -EACCES;
 
         hmacs = sctp_sk(sk)->ep->auth_hmacs_list;
-        param_len = ntohs(hmacs->param_hdr.length);
+        data_len = ntohs(hmacs->param_hdr.length) - sizeof(sctp_paramhdr_t);
 
-        if (len < param_len)
+        if (len < sizeof(struct sctp_hmacalgo) + data_len)
                 return -EINVAL;
+
+        len = sizeof(struct sctp_hmacalgo) + data_len;
+        num_idents = data_len / sizeof(u16);
+
         if (put_user(len, optlen))
                 return -EFAULT;
-        if (copy_to_user(optval, hmacs->hmac_ids, len))
+        if (put_user(num_idents, &p->shmac_num_idents))
+                return -EFAULT;
+        if (copy_to_user(p->shmac_idents, hmacs->hmac_ids, data_len))
                 return -EFAULT;
-
         return 0;
 }
 
@@ -5219,6 +5251,9 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
         struct sctp_authkeyid val;
         struct sctp_association *asoc;
 
+        if (!sctp_auth_enable)
+                return -EACCES;
+
         if (len < sizeof(struct sctp_authkeyid))
                 return -EINVAL;
         if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid)))
@@ -5233,6 +5268,12 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
         else
                 val.scact_keynumber = sctp_sk(sk)->ep->active_key_id;
 
+        len = sizeof(struct sctp_authkeyid);
+        if (put_user(len, optlen))
+                return -EFAULT;
+        if (copy_to_user(optval, &val, len))
+                return -EFAULT;
+
         return 0;
 }
 
@@ -5243,13 +5284,16 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
         struct sctp_authchunks val;
         struct sctp_association *asoc;
         struct sctp_chunks_param *ch;
-        u32    num_chunks;
+        u32    num_chunks = 0;
         char __user *to;
 
-        if (len <= sizeof(struct sctp_authchunks))
+        if (!sctp_auth_enable)
+                return -EACCES;
+
+        if (len < sizeof(struct sctp_authchunks))
                 return -EINVAL;
 
-        if (copy_from_user(&val, p, sizeof(struct sctp_authchunks)))
+        if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
                 return -EFAULT;
 
         to = p->gauth_chunks;
@@ -5258,20 +5302,21 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
                 return -EINVAL;
 
         ch = asoc->peer.peer_chunks;
+        if (!ch)
+                goto num;
 
         /* See if the user provided enough room for all the data */
         num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
         if (len < num_chunks)
                 return -EINVAL;
 
-        len = num_chunks;
-        if (put_user(len, optlen))
+        if (copy_to_user(to, ch->chunks, num_chunks))
                 return -EFAULT;
+num:
+        len = sizeof(struct sctp_authchunks) + num_chunks;
+        if (put_user(len, optlen)) return -EFAULT;
         if (put_user(num_chunks, &p->gauth_number_of_chunks))
                 return -EFAULT;
-        if (copy_to_user(to, ch->chunks, len))
-                return -EFAULT;
-
         return 0;
 }
 
@@ -5282,13 +5327,16 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
         struct sctp_authchunks val;
         struct sctp_association *asoc;
         struct sctp_chunks_param *ch;
-        u32    num_chunks;
+        u32    num_chunks = 0;
         char __user *to;
 
-        if (len <= sizeof(struct sctp_authchunks))
+        if (!sctp_auth_enable)
+                return -EACCES;
+
+        if (len < sizeof(struct sctp_authchunks))
                 return -EINVAL;
 
-        if (copy_from_user(&val, p, sizeof(struct sctp_authchunks)))
+        if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
                 return -EFAULT;
 
         to = p->gauth_chunks;
@@ -5301,17 +5349,21 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
         else
                 ch = sctp_sk(sk)->ep->auth_chunk_list;
 
+        if (!ch)
+                goto num;
+
         num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
-        if (len < num_chunks)
+        if (len < sizeof(struct sctp_authchunks) + num_chunks)
                 return -EINVAL;
 
-        len = num_chunks;
+        if (copy_to_user(to, ch->chunks, num_chunks))
+                return -EFAULT;
+num:
+        len = sizeof(struct sctp_authchunks) + num_chunks;
         if (put_user(len, optlen))
                 return -EFAULT;
         if (put_user(num_chunks, &p->gauth_number_of_chunks))
                 return -EFAULT;
-        if (copy_to_user(to, ch->chunks, len))
-                return -EFAULT;
 
         return 0;
 }