# Re: \[PATCH net\] sctp: fix the issue that a \_\_u16 variable may overflow in sctp\_ulpq\_renege

- From: David Miller \<davem@davemloft.net\>
- Date: 2017-12-18 18:22:16 
- List: netdev
- Page: https://ratatoskr.run/netdev/2017/12/11077068
- Thread: https://ratatoskr.run/netdev/2017/12/11076989/t.md

```text
From: Xin Long <lucien.xin@gmail.com>
Date: Mon, 18 Dec 2017 14:07:25 +0800

> Now when reneging events in sctp_ulpq_renege(), the variable freed
> could be increased by a __u16 value twice while freed is of __u16
> type. It means freed may overflow at the second addition.
> 
> This patch is to fix it by using __u32 type for 'freed', while at
> it, also to remove 'if (chunk)' check, as all renege commands are
> generated in sctp_eat_data and it can't be NULL.
> 
> Reported-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
> Signed-off-by: Xin Long <lucien.xin@gmail.com>

Applied.
```