diff options
| author | Yousef Alhouseen <alhouseenyousef@gmail.com> | 2026-06-25 16:23:54 +0200 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-06-27 15:39:35 -0700 |
| commit | 2b9f5ef534184bd81b8a4772780626c40eed1fd5 (patch) | |
| tree | 55ee039bfb26e5b8c7d70eb345ae410620d9d9b4 /rust/zerocopy/src/pointer/git@git.tavy.me:linux-stable.git | |
| parent | 555c5475e787802eeae0d2b91c2f66c330db2767 (diff) | |
sctp: fix SCTP_RESET_STREAMS stream list length limit
SCTP_RESET_STREAMS carries a flexible array of u16 stream IDs, but the
optlen clamps treat USHRT_MAX as a byte count and then multiply
sizeof(__u16) by the fixed header size.
That caps the copied and validated option buffer at about 64 KiB, which
rejects valid requests containing more than about half of the u16 stream
ID range.
Use struct_size_t() for the maximum struct sctp_reset_streams layout
instead, so the bound matches the flexible array described by
srs_number_streams.
Fixes: 5960cefab9df ("sctp: add a ceiling to optlen in some sockopts")
Acked-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://patch.msgid.link/20260625142354.2600-1-alhouseenyousef@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'rust/zerocopy/src/pointer/git@git.tavy.me:linux-stable.git')
0 files changed, 0 insertions, 0 deletions
