Messages in this thread Patch in this message | | | Date | Tue, 2 Aug 2005 23:53:48 -0700 | From | Chris Wright <> | Subject | [05/13] [NET]: Fix signedness issues in net/core/filter.c |
| |
-stable review patch. If anyone has any objections, please let us know.
------------------
This is the code to load packet data into a register:
k = fentry->k; if (k < 0) { ... } else { u32 _tmp, *p; p = skb_header_pointer(skb, k, 4, &_tmp); if (p != NULL) { A = ntohl(*p); continue; } }
skb_header_pointer checks if the requested data is within the linear area:
int hlen = skb_headlen(skb);
if (offset + len <= hlen) return skb->data + offset;
When offset is within [INT_MAX-len+1..INT_MAX] the addition will result in a negative number which is <= hlen.
I couldn't trigger a crash on my AMD64 with 2GB of memory, but a coworker tried on his x86 machine and it crashed immediately.
This patch fixes the check in skb_header_pointer to handle large positive offsets similar to skb_copy_bits. Invalid data can still be accessed using negative offsets (also similar to skb_copy_bits), anyone using negative offsets needs to verify them himself.
Thanks to Thomas Vögtle <thomas.voegtle@coreworks.de> for verifying the problem by crashing his machine and providing me with an Oops.
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- include/linux/skbuff.h | 2 +- 1 files changed, 1 insertion(+), 1 deletion(-)
--- linux-2.6.12.3.orig/include/linux/skbuff.h 2005-07-28 11:17:01.000000000 -0700 +++ linux-2.6.12.3/include/linux/skbuff.h 2005-07-28 11:17:12.000000000 -0700 @@ -1192,7 +1192,7 @@ { int hlen = skb_headlen(skb); - if (offset + len <= hlen) + if (hlen - offset >= len) return skb->data + offset; if (skb_copy_bits(skb, offset, buffer, len) < 0) - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |