Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1707749
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.9 43/93] ipv6: avoid overflow of offset in ip6_find_1stfragopt |
| Date | 2017-08-09 20:40 +0200 |
| Message-ID | <ucE3G-2ye-75@gated-at.bofh.it> (permalink) |
| References | <ucDKh-2qd-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <sd@queasysnail.net>
[ Upstream commit 6399f1fae4ec29fab5ec76070435555e256ca3a6 ]
In some cases, offset can overflow and can cause an infinite loop in
ip6_find_1stfragopt(). Make it unsigned int to prevent the overflow, and
cap it at IPV6_MAXPLEN, since packets larger than that should be invalid.
This problem has been here since before the beginning of git history.
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/output_core.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -78,7 +78,7 @@ EXPORT_SYMBOL(ipv6_select_ident);
int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
{
- u16 offset = sizeof(struct ipv6hdr);
+ unsigned int offset = sizeof(struct ipv6hdr);
unsigned int packet_len = skb_tail_pointer(skb) -
skb_network_header(skb);
int found_rhdr = 0;
@@ -86,6 +86,7 @@ int ip6_find_1stfragopt(struct sk_buff *
while (offset <= packet_len) {
struct ipv6_opt_hdr *exthdr;
+ unsigned int len;
switch (**nexthdr) {
@@ -111,7 +112,10 @@ int ip6_find_1stfragopt(struct sk_buff *
exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
offset);
- offset += ipv6_optlen(exthdr);
+ len = ipv6_optlen(exthdr);
+ if (len + offset >= IPV6_MAXPLEN)
+ return -EINVAL;
+ offset += len;
*nexthdr = &exthdr->nexthdr;
}
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.9 00/93] 4.9.42-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 23/93] gpiolib: skip unwanted events, dont convert them to opposite edge Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 19/93] timers: Fix overflow in get_next_timer_interrupt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 26/93] ARM: dts: armada-38x: Fix irq type for pca955 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 06/93] iwlwifi: dvm: prevent an out of bounds access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 41/93] ipv4: ipv6: initialize treq->txhash in cookie_v[46]_check() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 37/93] tcp_bbr: introduce bbr_bw_to_pacing_rate() helper Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 10/93] device property: Make dev_fwnode() public Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 40/93] tcp_bbr: init pacing rate on first RTT sample Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 11/93] mmc: core: Fix access to HS400-ES devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 21/93] powerpc/64: Fix __check_irq_replay missing decrementer interrupt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 36/93] tcp_bbr: cut pacing rate only if filled pipe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 12/93] mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 24/93] ext4: fix SEEK_HOLE/SEEK_DATA for blocksize < pagesize Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 20/93] powerpc/tm: Fix saving of TM SPRs in core dump Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 33/93] f2fs: sanity check checkpoint segno and blkoff Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 29/93] iscsi-target: Fix initial login PDU asynchronous socket close OOPs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 35/93] [media] saa7164: fix double fetch PCIe access condition Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 32/93] media: lirc: LIRC_GET_REC_RESOLUTION should return microseconds Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 01/93] parisc: Handle vmas whose context is not current in flush_cache_range Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 44/93] net: dsa: b53: Add missing ARL entries for BCM53125 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 08/93] NFSv4: Fix EXCHANGE_ID corrupt verifier issue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 [PATCH 4.9 43/93] ipv6: avoid overflow of offset in ip6_find_1stfragopt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-09 20:40 +0200 Re: [PATCH 4.9 00/93] 4.9.42-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-08-10 02:20 +0200 Re: [PATCH 4.9 00/93] 4.9.42-stable review Guenter Roeck <linux@roeck-us.net> - 2017-08-10 02:50 +0200 Re: [PATCH 4.9 00/93] 4.9.42-stable review Sumit Semwal <sumit.semwal@linaro.org> - 2017-08-10 05:10 +0200
csiph-web