lkml.org 
[lkml]   [2006]   [May]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [netfilter-core] Re: [lockup] 2.6.17-rc3: netfilter/sctp: lockup in sctp_new(), do_basic_checks()

    * Patrick McHardy <kaber@trash.net> wrote:

    > Ingo Molnar wrote:
    > > thinking about it, what prevents the SCTP chunk's len field from being
    > > zero, and thus causing an infinite loop in for_each_sctp_chunk()? The
    > > patch below should fix that.
    > >
    > > Ingo
    > >
    > > ----
    > > From: Ingo Molnar <mingo@elte.hu>
    > >
    > > fix infinite loop in the SCTP-netfilter code: check SCTP chunk size to
    > > guarantee progress of for_each_sctp_chunk(). (all other uses of
    > > for_each_sctp_chunk() are preceded by do_basic_checks(), so this fix
    > > should be complete.)
    > >
    > > Signed-off-by: Ingo Molnar <mingo@elte.hu>
    > >
    > > Index: linux/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
    > > ===================================================================
    > > --- linux.orig/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
    > > +++ linux/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
    > > @@ -227,6 +227,15 @@ static int do_basic_checks(struct ip_con
    > > flag = 0;
    > >
    > > for_each_sctp_chunk (skb, sch, _sch, offset, count) {
    > > + unsigned int len = (htons(sch->length) + 3) & ~3;
    > > +
    > > + /*
    > > + * Dont get into a loop with zero-sized or negative
    > > + * length values:
    > > + */
    > > + if (!len || len >= skb->len)
    > > + goto fail;
    > > +
    >
    > I just came up with a similar fix :) I think I'm going to take my own
    > patch though because its IMO slightly nicer. Thanks anyway.

    could you send your patch so that i can start using it instead of mine?

    Ingo
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2006-05-02 15:58    [W:0.027 / U:70.520 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site