summaryrefslogtreecommitdiff
path: root/rust/zerocopy/src/pointer/git@git.tavy.me:linux-stable.git
diff options
context:
space:
mode:
authorYousef Alhouseen <alhouseenyousef@gmail.com>2026-06-25 16:23:54 +0200
committerJakub Kicinski <kuba@kernel.org>2026-06-27 15:39:35 -0700
commit2b9f5ef534184bd81b8a4772780626c40eed1fd5 (patch)
tree55ee039bfb26e5b8c7d70eb345ae410620d9d9b4 /rust/zerocopy/src/pointer/git@git.tavy.me:linux-stable.git
parent555c5475e787802eeae0d2b91c2f66c330db2767 (diff)
sctp: fix SCTP_RESET_STREAMS stream list length limit
SCTP_RESET_STREAMS carries a flexible array of u16 stream IDs, but the optlen clamps treat USHRT_MAX as a byte count and then multiply sizeof(__u16) by the fixed header size. That caps the copied and validated option buffer at about 64 KiB, which rejects valid requests containing more than about half of the u16 stream ID range. Use struct_size_t() for the maximum struct sctp_reset_streams layout instead, so the bound matches the flexible array described by srs_number_streams. Fixes: 5960cefab9df ("sctp: add a ceiling to optlen in some sockopts") Acked-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Link: https://patch.msgid.link/20260625142354.2600-1-alhouseenyousef@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'rust/zerocopy/src/pointer/git@git.tavy.me:linux-stable.git')
0 files changed, 0 insertions, 0 deletions