Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1525942

[PATCH 4.4 09/37] ipv6: dccp: fix out of bound access in dccp_v6_err()

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edumazet@google.com>


[ Upstream commit 1aa9d1a0e7eefcc61696e147d123453fc0016005 ]

dccp_v6_err() does not use pskb_may_pull() and might access garbage.

We only need 4 bytes at the beginning of the DCCP header, like TCP,
so the 8 bytes pulled in icmpv6_notify() are more than enough.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/dccp/ipv6.c |   15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -70,7 +70,7 @@ static void dccp_v6_err(struct sk_buff *
 			u8 type, u8 code, int offset, __be32 info)
 {
 	const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
-	const struct dccp_hdr *dh = (struct dccp_hdr *)(skb->data + offset);
+	const struct dccp_hdr *dh;
 	struct dccp_sock *dp;
 	struct ipv6_pinfo *np;
 	struct sock *sk;
@@ -78,12 +78,13 @@ static void dccp_v6_err(struct sk_buff *
 	__u64 seq;
 	struct net *net = dev_net(skb->dev);
 
-	if (skb->len < offset + sizeof(*dh) ||
-	    skb->len < offset + __dccp_basic_hdr_len(dh)) {
-		ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
-				   ICMP6_MIB_INERRORS);
-		return;
-	}
+	/* Only need dccph_dport & dccph_sport which are the first
+	 * 4 bytes in dccp header.
+	 * Our caller (icmpv6_notify()) already pulled 8 bytes for us.
+	 */
+	BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_sport) > 8);
+	BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8);
+	dh = (struct dccp_hdr *)(skb->data + offset);
 
 	sk = __inet6_lookup_established(net, &dccp_hashinfo,
 					&hdr->daddr, dh->dccph_dport,

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/37] 4.4.34-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 31/37] sparc64: Convert U1copy_{from,to}_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 02/37] net: clear sk_err_soft in sk_clone_lock() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 12/37] fib_trie: Correct /proc/net/route off by one error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 27/37] sparc64: Delete __ret_efault. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 25/37] sparc64: Fix illegal relative branches in hypervisor patched TLB cross-call code. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 10/37] ipv6: dccp: add missing bind_conflict to dccp_ipv6_mapped Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 32/37] sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 24/37] sparc64: Fix instruction count in comment for __hypervisor_flush_tlb_pending. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 07/37] dccp: do not send reset to already closed sockets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 14/37] net: __skb_flow_dissect() must cap its return value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 30/37] sparc64: Convert GENcopy_{from,to}_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 05/37] ip6_tunnel: Clear IP6CB in ip6tunnel_xmit() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 35/37] sparc64: Convert U3copy_{from,to}_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 33/37] sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 11/37] sctp: assign assoc_id earlier in __sctp_connect Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 19/37] sparc: serial: sunhv: fix a double lock bug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 16/37] tcp: take care of truncations done by sk_filter() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 23/37] sparc64: Fix illegal relative branches in hypervisor patched TLB code. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:30 +0100
  [PATCH 4.4 36/37] sparc64: Delete now unused user copy assembler helpers. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 09/37] ipv6: dccp: fix out of bound access in dccp_v6_err() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 17/37] tty: Prevent ldisc drivers from re-using stale tty fields Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 26/37] sparc64: Handle extremely large kernel TLB range flushes more gracefully. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 29/37] sparc64: Convert copy_in_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 34/37] sparc64: Convert NG2copy_{from,to}_user to accurate exception reporting. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 15/37] ipv4: use new_gw for redirect neigh lookup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 37/37] sparc64: Delete now unused user copy fixup functions. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:40 +0100
  [PATCH 4.4 01/37] dctcp: avoid bogus doubling of cwnd after loss Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:50 +0100
  [PATCH 4.4 20/37] sparc64 mm: Fix base TSB sizing when hugetlb pages are used Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:50 +0100
  [PATCH 4.4 04/37] bgmac: stop clearing DMA receive control register right after it is set Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:50 +0100
  [PATCH 4.4 21/37] sparc: Handle negative offsets in arch_jump_label_transform Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:50 +0100
  [PATCH 4.4 08/37] dccp: fix out of bound access in dccp_v4_err() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:50 +0100
  [PATCH 4.4 22/37] sparc64: Handle extremely large kernel TSB range flushes sanely. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-19 10:50 +0100
  Re: [PATCH 4.4 00/37] 4.4.34-stable review Guenter Roeck <linux@roeck-us.net> - 2016-11-19 17:30 +0100
  Re: [PATCH 4.4 00/37] 4.4.34-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-11-21 17:40 +0100
    Re: [PATCH 4.4 00/37] 4.4.34-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-21 17:50 +0100

csiph-web