[PATCH 3.16 334/370] dccp: fix out of bound access in dccp_v4_err()

Path	csiph.com!1.us.feeder.erje.net!feeder.erje.net!2.eu.feeder.erje.net!news.unit0.net!news.panservice.it!bofh.it!news.nic.it!robomod
From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.kernel
Subject	[PATCH 3.16 334/370] dccp: fix out of bound access in dccp_v4_err()
Date	Fri, 10 Mar 2017 14:30:03 +0100
Message-ID	<tjsMj-4Ar-69@gated-at.bofh.it> (permalink)
References	<tjrnb-3sF-3@gated-at.bofh.it>
Content-Type	text/plain; charset="UTF-8"
Content-Disposition	inline
Content-Transfer-Encoding	8bit
MIME-Version	1.0
X-Mailer	LinuxStableQueue (scripts by bwh)
X-Sa-Exim-Connect-IP	82.70.136.246
X-Sa-Exim-Mail-From	ben@decadent.org.uk
X-Sa-Exim-Scanned	No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	56
Organization	linux.* mail to news gateway
X-Original-Cc	akpm@linux-foundation.org, "Eric Dumazet" <edumazet@google.com>, "David S. Miller" <davem@davemloft.net>
X-Original-Date	Fri, 10 Mar 2017 11:46:23 +0000
X-Original-Message-ID	<lsq.1489146383.375874546@decadent.org.uk>
X-Original-References	<lsq.1489146380.780052105@decadent.org.uk>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1597589

Show key headers only | View raw

3.16.42-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 6706a97fec963d6cb3f7fc2978ec1427b4651214 ]

dccp_v4_err() does not use pskb_may_pull() and might access garbage.

We only need 4 bytes at the beginning of the DCCP header, like TCP,
so the 8 bytes pulled in icmp_socket_deliver() are more than enough.

This patch might allow to process more ICMP messages, as some routers
are still limiting the size of reflected bytes to 28 (RFC 792), instead
of extended lengths (RFC 1812 4.3.2.3)

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: use offsetof() + sizeof() instead of
 offsetofend()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 net/dccp/ipv4.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -213,7 +213,7 @@ static void dccp_v4_err(struct sk_buff *
 {
 	const struct iphdr *iph = (struct iphdr *)skb->data;
 	const u8 offset = iph->ihl << 2;
-	const struct dccp_hdr *dh = (struct dccp_hdr *)(skb->data + offset);
+	const struct dccp_hdr *dh;
 	struct dccp_sock *dp;
 	struct inet_sock *inet;
 	const int type = icmp_hdr(skb)->type;
@@ -223,11 +223,13 @@ static void dccp_v4_err(struct sk_buff *
 	int err;
 	struct net *net = dev_net(skb->dev);
 
-	if (skb->len < offset + sizeof(*dh) ||
-	    skb->len < offset + __dccp_basic_hdr_len(dh)) {
-		ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
-		return;
-	}
+	/* Only need dccph_dport & dccph_sport which are the first
+	 * 4 bytes in dccp header.
+	 * Our caller (icmp_socket_deliver()) already pulled 8 bytes for us.
+	 */
+	BUILD_BUG_ON(offsetof(struct dccp_hdr, dccph_sport) + sizeof(dh->dccph_sport) > 8);
+	BUILD_BUG_ON(offsetof(struct dccp_hdr, dccph_dport) + sizeof(dh->dccph_dport) > 8);
+	dh = (struct dccp_hdr *)(skb->data + offset);
 
 	sk = inet_lookup(net, &dccp_hashinfo,
 			iph->daddr, dh->dccph_dport,

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

[PATCH 3.16 334/370] dccp: fix out of bound access in dccp_v4_err() Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:30 +0100

csiph-web