Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1268769
| From | Luis Henriques <luis.henriques@canonical.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.16.y-ckt 89/94] ppp, slip: Validate VJ compression slot parameters completely |
| Date | 2015-11-13 11:20 +0100 |
| Message-ID | <qujCy-56Q-45@gated-at.bofh.it> (permalink) |
| References | <qujCx-56Q-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.16.7-ckt20 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
commit 4ab42d78e37a294ac7bc56901d563c642e03c4ae upstream.
Currently slhc_init() treats out-of-range values of rslots and tslots
as equivalent to 0, except that if tslots is too large it will
dereference a null pointer (CVE-2015-7799).
Add a range-check at the top of the function and make it return an
ERR_PTR() on error instead of NULL. Change the callers accordingly.
Compile-tested only.
Reported-by: 郭永刚 <guoyonggang@360.cn>
References: http://article.gmane.org/gmane.comp.security.oss.general/17908
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Moritz Mühlenhoff <jmm@inutil.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
drivers/isdn/i4l/isdn_ppp.c | 10 ++++------
drivers/net/ppp/ppp_generic.c | 6 ++----
drivers/net/slip/slhc.c | 12 ++++++++----
drivers/net/slip/slip.c | 2 +-
4 files changed, 15 insertions(+), 15 deletions(-)
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index 29d1cc0b2bc4..1025ef1a3988 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -322,9 +322,9 @@ isdn_ppp_open(int min, struct file *file)
* VJ header compression init
*/
is->slcomp = slhc_init(16, 16); /* not necessary for 2. link in bundle */
- if (!is->slcomp) {
+ if (IS_ERR(is->slcomp)) {
isdn_ppp_ccp_reset_free(is);
- return -ENOMEM;
+ return PTR_ERR(is->slcomp);
}
#endif
#ifdef CONFIG_IPPP_FILTER
@@ -573,10 +573,8 @@ isdn_ppp_ioctl(int min, struct file *file, unsigned int cmd, unsigned long arg)
is->maxcid = val;
#ifdef CONFIG_ISDN_PPP_VJ
sltmp = slhc_init(16, val);
- if (!sltmp) {
- printk(KERN_ERR "ippp, can't realloc slhc struct\n");
- return -ENOMEM;
- }
+ if (IS_ERR(sltmp))
+ return PTR_ERR(sltmp);
if (is->slcomp)
slhc_free(is->slcomp);
is->slcomp = sltmp;
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index dbf56debb7e3..65edd34654ee 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -709,10 +709,8 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
val &= 0xffff;
}
vj = slhc_init(val2+1, val+1);
- if (!vj) {
- netdev_err(ppp->dev,
- "PPP: no memory (VJ compressor)\n");
- err = -ENOMEM;
+ if (IS_ERR(vj)) {
+ err = PTR_ERR(vj);
break;
}
ppp_lock(ppp);
diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
index 1252d9c726a7..b52eabc168a0 100644
--- a/drivers/net/slip/slhc.c
+++ b/drivers/net/slip/slhc.c
@@ -84,8 +84,9 @@ static long decode(unsigned char **cpp);
static unsigned char * put16(unsigned char *cp, unsigned short x);
static unsigned short pull16(unsigned char **cpp);
-/* Initialize compression data structure
+/* Allocate compression data structure
* slots must be in range 0 to 255 (zero meaning no compression)
+ * Returns pointer to structure or ERR_PTR() on error.
*/
struct slcompress *
slhc_init(int rslots, int tslots)
@@ -94,11 +95,14 @@ slhc_init(int rslots, int tslots)
register struct cstate *ts;
struct slcompress *comp;
+ if (rslots < 0 || rslots > 255 || tslots < 0 || tslots > 255)
+ return ERR_PTR(-EINVAL);
+
comp = kzalloc(sizeof(struct slcompress), GFP_KERNEL);
if (! comp)
goto out_fail;
- if ( rslots > 0 && rslots < 256 ) {
+ if (rslots > 0) {
size_t rsize = rslots * sizeof(struct cstate);
comp->rstate = kzalloc(rsize, GFP_KERNEL);
if (! comp->rstate)
@@ -106,7 +110,7 @@ slhc_init(int rslots, int tslots)
comp->rslot_limit = rslots - 1;
}
- if ( tslots > 0 && tslots < 256 ) {
+ if (tslots > 0) {
size_t tsize = tslots * sizeof(struct cstate);
comp->tstate = kzalloc(tsize, GFP_KERNEL);
if (! comp->tstate)
@@ -141,7 +145,7 @@ out_free2:
out_free:
kfree(comp);
out_fail:
- return NULL;
+ return ERR_PTR(-ENOMEM);
}
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index 87526443841f..0641fccdc954 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -164,7 +164,7 @@ static int sl_alloc_bufs(struct slip *sl, int mtu)
if (cbuff == NULL)
goto err_exit;
slcomp = slhc_init(16, 16);
- if (slcomp == NULL)
+ if (IS_ERR(slcomp))
goto err_exit;
#endif
spin_lock_bh(&sl->lock);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[3.16.y-ckt stable] Linux 3.16.7-ckt20 stable review Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:20 +0100 [PATCH 3.16.y-ckt 05/94] svcrdma: handle rdma read with a non-zero initial page offset Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:20 +0100 [PATCH 3.16.y-ckt 92/94] sfc: Fix memcpy() with const destination compiler warning. Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:20 +0100 [PATCH 3.16.y-ckt 89/94] ppp, slip: Validate VJ compression slot parameters completely Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:20 +0100 [PATCH 3.16.y-ckt 88/94] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:20 +0100 [PATCH 3.16.y-ckt 52/94] ASoC: Add info callback for SX_TLV controls Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:20 +0100 [PATCH 3.16.y-ckt 46/94] ARM: orion: Fix DSA platform device after mvmdio conversion Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:20 +0100 [PATCH 3.16.y-ckt 43/94] iwlwifi: mvm: fix D3 firmware PN programming Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:20 +0100 [PATCH 3.16.y-ckt 35/94] i2c: designware: Do not use parameters from ACPI on Dell Inspiron 7348 Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:20 +0100 [PATCH 3.16.y-ckt 14/94] usb: Add device quirk for Logitech PTZ cameras Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:20 +0100 [PATCH 3.16.y-ckt 22/94] drm/radeon: add pm sysfs files late Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:20 +0100 [PATCH 3.16.y-ckt 39/94] rbd: fix double free on rbd_dev->header_name Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:20 +0100 [PATCH 3.16.y-ckt 71/94] i2c: mv64xxx: really allow I2C offloading Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:20 +0100 [PATCH 3.16.y-ckt 91/94] power: bq24190_charger: suppress build warning Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:20 +0100 [PATCH 3.16.y-ckt 90/94] staging/dgnc: fix info leak in ioctl Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:20 +0100 [PATCH 3.16.y-ckt 33/94] i2c: s3c2410: enable RuntimePM before registering to the core Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:20 +0100 [PATCH 3.16.y-ckt 86/94] serial: 8250_pci: Add support for 12 port Exar boards Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:20 +0100 [PATCH 3.16.y-ckt 94/94] sched/preempt: Fix cond_resched_lock() and cond_resched_softirq() Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:20 +0100 [PATCH 3.16.y-ckt 93/94] sched/preempt: Rename PREEMPT_CHECK_OFFSET to PREEMPT_DISABLE_OFFSET Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:20 +0100 [PATCH 3.16.y-ckt 65/94] iwlwifi: mvm: init card correctly on ctkill exit check Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:30 +0100 [PATCH 3.16.y-ckt 70/94] iommu/amd: Don't clear DTE flags when modifying it Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:30 +0100 [PATCH 3.16.y-ckt 77/94] drm/radeon: fix dpms when driver backlight control is disabled Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:30 +0100 [PATCH 3.16.y-ckt 69/94] md/raid10: submit_bio_wait() returns 0 on success Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:30 +0100 [PATCH 3.16.y-ckt 67/94] crypto: api - Only abort operations on fatal signal Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:30 +0100 [PATCH 3.16.y-ckt 66/94] module: Fix locking in symbol_put_addr() Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:30 +0100 [PATCH 3.16.y-ckt 74/94] Revert "ARM64: unwind: Fix PC calculation" Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:30 +0100 [PATCH 3.16.y-ckt 82/94] ppp: fix pppoe_dev deletion condition in pppoe_release() Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:30 +0100 [PATCH 3.16.y-ckt 72/94] drm/radeon: don't try to recreate sysfs entries on resume Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:30 +0100 [PATCH 3.16.y-ckt 63/94] dm btree: fix leak of bufio-backed block in btree_split_beneath error path Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:30 +0100 [PATCH 3.16.y-ckt 55/94] xhci: Add spurious wakeup quirk for LynxPoint-LP controllers Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:30 +0100 [PATCH 3.16.y-ckt 80/94] Revert "md: allow a partially recovered device to be hot-added to an array." Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:30 +0100 [PATCH 3.16.y-ckt 76/94] drm/radeon: move bl encoder assignment into bl init Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:30 +0100 [PATCH 3.16.y-ckt 83/94] ipv6: gre: support SIT encapsulation Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:30 +0100 [PATCH 3.16.y-ckt 50/94] drm/i915: Deny wrapping an userptr into a framebuffer Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:40 +0100 [PATCH 3.16.y-ckt 58/94] powerpc/rtas: Validate rtas.entry before calling enter_rtas() Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:40 +0100 [PATCH 3.16.y-ckt 53/94] xhci: don't finish a TD if we get a short transfer event mid TD Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:40 +0100 [PATCH 3.16.y-ckt 48/94] iio: mxs-lradc: Fix temperature offset Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:40 +0100 [PATCH 3.16.y-ckt 62/94] dm btree remove: fix a bug when rebalancing nodes after removal Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:40 +0100 [PATCH 3.16.y-ckt 57/94] drm/nouveau/gem: return only valid domain when there's only one Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:40 +0100 [PATCH 3.16.y-ckt 59/94] mm: make sendfile(2) killable Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:40 +0100 [PATCH 3.16.y-ckt 56/94] ASoC: wm8904: Correct number of EQ registers Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:40 +0100 [PATCH 3.16.y-ckt 44/94] iwlwifi: fix firmware filename for 3160 Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:40 +0100 [PATCH 3.16.y-ckt 45/94] iwlwifi: pci: add a few more PCI subvendor IDs for the 7265 series Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:40 +0100 [PATCH 3.16.y-ckt 54/94] xhci: handle no ping response error properly Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:40 +0100 [PATCH 3.16.y-ckt 47/94] xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing) Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:40 +0100 [PATCH 3.16.y-ckt 51/94] x86/efi: Fix multiple GOP device support Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:40 +0100 [PATCH 3.16.y-ckt 49/94] ALSA: hda - Fix inverted internal mic on Lenovo G50-80 Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:40 +0100 [PATCH 3.16.y-ckt 61/94] rbd: prevent kernel stack blow up on rbd map Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:40 +0100 [PATCH 3.16.y-ckt 23/94] drm/radeon: add quirk for MSI R7 370 Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:50 +0100 [PATCH 3.16.y-ckt 34/94] i2c: designware-platdrv: enable RuntimePM before registering to the core Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:50 +0100 [PATCH 3.16.y-ckt 36/94] btrfs: fix possible leak in btrfs_ioctl_balance() Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:50 +0100 [PATCH 3.16.y-ckt 27/94] arm64: errata: use KBUILD_CFLAGS_MODULE for erratum #843419 Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:50 +0100 [PATCH 3.16.y-ckt 41/94] iio: accel: sca3000: memory corruption in sca3000_read_first_n_hw_rb() Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:50 +0100 [PATCH 3.16.y-ckt 31/94] btrfs: fix use after free iterating extrefs Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:50 +0100 [PATCH 3.16.y-ckt 29/94] dm thin: fix missing pool reference count decrement in pool_ctr error path Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:50 +0100 [PATCH 3.16.y-ckt 38/94] usb: xhci: Add support for URB_ZERO_PACKET to bulk/sg transfers Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:50 +0100 [PATCH 3.16.y-ckt 30/94] btrfs: check unsupported filters in balance arguments Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:50 +0100 [PATCH 3.16.y-ckt 42/94] iwlwifi: dvm: fix D3 firmware PN programming Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:50 +0100 [PATCH 3.16.y-ckt 28/94] crypto: ahash - ensure statesize is non-zero Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:50 +0100 [PATCH 3.16.y-ckt 40/94] ath9k: declare required extra tx headroom Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 11:50 +0100 [PATCH 3.16.y-ckt 25/94] crypto: sparc - initialize blkcipher.ivsize Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100 [PATCH 3.16.y-ckt 21/94] workqueue: make sure delayed work run in local cpu Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100 [PATCH 3.16.y-ckt 04/94] s390/boot/decompression: disable floating point in decompressor Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100 [PATCH 3.16.y-ckt 10/94] dm raid: fix round up of default region size Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100 [PATCH 3.16.y-ckt 11/94] ALSA: hda: Add dock support for ThinkPad T550 Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100 [PATCH 3.16.y-ckt 16/94] ALSA: synth: Fix conflicting OSS device registration on AWE32 Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100 [PATCH 3.16.y-ckt 13/94] USB: Add reset-resume quirk for two Plantronics usb headphones. Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100 [PATCH 3.16.y-ckt 03/94] x86/xen: Support kexec/kdump in HVM guests by doing a soft reset Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100 [PATCH 3.16.y-ckt 02/94] regmap: debugfs: Don't bother actually printing when calculating max length Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100 [PATCH 3.16.y-ckt 09/94] ASoC: dwc: correct irq clear method Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100 [PATCH 3.16.y-ckt 12/94] ALSA: hda - Apply SPDIF pin ctl to MacBookPro 12,1 Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100 [PATCH 3.16.y-ckt 06/94] dm: fix AB-BA deadlock in __dm_destroy() Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100 [PATCH 3.16.y-ckt 26/94] drm/nouveau/fbcon: take runpm reference when userspace has an open fd Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100 [PATCH 3.16.y-ckt 15/94] staging: speakup: fix speakup-r regression Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100 [PATCH 3.16.y-ckt 20/94] 3w-9xxx: don't unmap bounce buffered commands Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100 [PATCH 3.16.y-ckt 17/94] arm64: readahead: fault retry breaks mmap file read random detection Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100 [PATCH 3.16.y-ckt 01/94] regmap: debugfs: Ensure we don't underflow when printing access masks Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100 [PATCH 3.16.y-ckt 24/94] drm/radeon: add quirk for ASUS R7 370 Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100 [PATCH 3.16.y-ckt 07/94] [SMB3] Do not fall back to SMBWriteX in set_file_size error cases Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100 [PATCH 3.16.y-ckt 18/94] sched/core: Fix TASK_DEAD race in finish_task_switch() Luis Henriques <luis.henriques@canonical.com> - 2015-11-13 12:00 +0100
csiph-web