Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1388023

[PATCH 3.19.y-ckt 09/66] net: validate variable length ll headers

Show all headers | View raw

3.19.8-ckt20 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Willem de Bruijn <willemb@google.com>

[ Upstream commit 2793a23aacbd754dbbb5cb75093deb7e4103bace ]

Netdevice parameter hard_header_len is variously interpreted both as
an upper and lower bound on link layer header length. The field is
used as upper bound when reserving room at allocation, as lower bound
when validating user input in PF_PACKET.

Clarify the definition to be maximum header length. For validation
of untrusted headers, add an optional validate member to header_ops.

Allow bypassing of validation by passing CAP_SYS_RAWIO, for instance
for deliberate testing of corrupt input. In this case, pad trailing
bytes, as some device drivers expect completely initialized headers.

See also http://comments.gmane.org/gmane.linux.network/401064

Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 include/linux/netdevice.h | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 840fb7f..b186193 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -265,6 +265,7 @@ struct header_ops {
 	void	(*cache_update)(struct hh_cache *hh,
 				const struct net_device *dev,
 				const unsigned char *haddr);
+	bool	(*validate)(const char *ll_header, unsigned int len);
 };
 
 /* These flag bits are private to the generic network queueing
@@ -1356,7 +1357,7 @@ enum netdev_priv_flags {
  *	@dma:		DMA channel
  *	@mtu:		Interface MTU value
  *	@type:		Interface hardware type
- *	@hard_header_len: Hardware header length
+ *	@hard_header_len: Maximum hardware header length.
  *
  *	@needed_headroom: Extra headroom the hardware may need, but not in all
  *			  cases can this be guaranteed
@@ -2339,6 +2340,24 @@ static inline int dev_rebuild_header(struct sk_buff *skb)
 	return dev->header_ops->rebuild(skb);
 }
 
+/* ll_header must have at least hard_header_len allocated */
+static inline bool dev_validate_header(const struct net_device *dev,
+				       char *ll_header, int len)
+{
+	if (likely(len >= dev->hard_header_len))
+		return true;
+
+	if (capable(CAP_SYS_RAWIO)) {
+		memset(ll_header + len, 0, dev->hard_header_len - len);
+		return true;
+	}
+
+	if (dev->header_ops && dev->header_ops->validate)
+		return dev->header_ops->validate(ll_header, len);
+
+	return false;
+}
+
 typedef int gifconf_func_t(struct net_device * dev, char __user * bufptr, int len);
 int register_gifconf(unsigned int family, gifconf_func_t *gifconf);
 static inline int unregister_gifconf(unsigned int family)
-- 
2.7.4

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[3.19.y-ckt stable] Linux 3.19.8-ckt20 stable review Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:30 +0200
  [PATCH 3.19.y-ckt 09/66] net: validate variable length ll headers Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:30 +0200
  [PATCH 3.19.y-ckt 53/66] x86/mm/xen: Suppress hugetlbfs in PV guests Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:30 +0200
  [PATCH 3.19.y-ckt 63/66] Input: pmic8xxx-pwrkey - fix algorithm for converting trigger delay Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:30 +0200
  [PATCH 3.19.y-ckt 45/66] drm/radeon: add a quirk for a XFX R9 270X Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:30 +0200
  [PATCH 3.19.y-ckt 62/66] net: bcmgenet: device stats are unsigned long Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:30 +0200
  [PATCH 3.19.y-ckt 21/66] ARM: OMAP2+: hwmod: Fix updating of sysconfig register Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:30 +0200
  [PATCH 3.19.y-ckt 38/66] crypto: sha1-mb - use corrcet pointer while completing jobs Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 44/66] powerpc: Update TM user feature bits in scan_features() Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 18/66] ipv4: l2tp: fix a potential issue in l2tp_ip_recv Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 33/66] usb: xhci: fix wild pointers in xhci_mem_cleanup Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 39/66] crypto: ccp - Prevent information leakage on export Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 43/66] powerpc: Update cpu_user_features2 in scan_features() Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 48/66] ALSA: pcxhr: Fix missing mutex unlock Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 47/66] futex: Acknowledge a new waiter in counter before plist Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 36/66] USB: uas: Add a new NO_REPORT_LUNS quirk Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 50/66] drm/radeon: forbid mapping of userptr bo through radeon device file Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 34/66] usb: xhci: fix xhci locking up during hcd remove Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 46/66] futex: Handle unlock_pi race gracefully Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 30/66] usb: xhci: applying XHCI_PME_STUCK_QUIRK to Intel BXT B0 host Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 35/66] xhci: fix 10 second timeout on removal of PCI hotpluggable xhci controllers Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 27/66] ALSA: hda - Fix regression of monitor_present flag in eld proc file Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 22/66] drm/qxl: fix cursor position with non-zero hotspot Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 42/66] powerpc: scan_features() updates incorrect bits for REAL_LE Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 23/66] Input: gtco - fix crash on detecting device without endpoints Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 41/66] ALSA: hda/realtek - Add ALC3234 headset mode for Optiplex 9020m Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 59/66] bpf/verifier: reject invalid LD_ABS | BPF_DW instruction Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 31/66] xhci: resume USB 3 roothub first Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 37/66] usb: hcd: out of bounds access in for_each_companion Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 32/66] usb: host: xhci: add a new quirk XHCI_NO_64BIT_SUPPORT Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 29/66] lib: lz4: fixed zram with lz4 on big endian machines Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 40/66] video: ARM CLCD: runtime check for Versatile Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 26/66] nl80211: check netlink protocol in socket release notification Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 28/66] dmaengine: dw: fix master selection Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 25/66] ALSA: usb-audio: Skip volume controls triggers hangup on Dell USB Dock Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:40 +0200
  [PATCH 3.19.y-ckt 08/66] udp6: fix UDP/IPv6 encap resubmit path Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:50 +0200
  [PATCH 3.19.y-ckt 11/66] macvtap: always pass ethernet header in linear Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:50 +0200
  [PATCH 3.19.y-ckt 16/66] qmi_wwan: add "D-Link DWM-221 B1" device id Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:50 +0200
  [PATCH 3.19.y-ckt 10/66] sh_eth: fix NULL pointer dereference in sh_eth_ring_format() Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:50 +0200
  [PATCH 3.19.y-ckt 01/66] usbnet: cleanup after bind() in probe() Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:50 +0200
  [PATCH 3.19.y-ckt 05/66] sctp: lack the check for ports in sctp_v6_cmp_addr Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:50 +0200
  [PATCH 3.19.y-ckt 02/66] tunnel: Clear IPCB(skb)->opt before dst_link_failure called Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:50 +0200
  [PATCH 3.19.y-ckt 04/66] net: qca_spi: clear IFF_TX_SKB_SHARING Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:50 +0200
  [PATCH 3.19.y-ckt 17/66] rtnl: fix msg size calculation in if_nlmsg_size() Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:50 +0200
  [PATCH 3.19.y-ckt 15/66] xfrm: Fix crash observed during device unregistration and decryption Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:50 +0200
  [PATCH 3.19.y-ckt 20/66] HID: usbhid: fix inconsistent reset/resume/reset-resume behavior Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:50 +0200
  [PATCH 3.19.y-ckt 14/66] bonding: fix bond_get_stats() Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:50 +0200
  [PATCH 3.19.y-ckt 07/66] cdc_ncm: toggle altsetting to force reset before setup Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:50 +0200
  [PATCH 3.19.y-ckt 19/66] ipv6: l2tp: fix a potential issue in l2tp_ip6_recv Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:50 +0200
  [PATCH 3.19.y-ckt 12/66] farsync: fix off-by-one bug in fst_add_one Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:50 +0200
  [PATCH 3.19.y-ckt 06/66] qmi_wwan: add Sierra Wireless EM74xx device ID Kamal Mostafa <kamal@canonical.com> - 2016-04-26 22:50 +0200

csiph-web