lkml.org 
[lkml]   [2005]   [Aug]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[05/13] [NET]: Fix signedness issues in net/core/filter.c
-stable review patch.  If anyone has any objections, please let us know.

------------------

This is the code to load packet data into a register:

k = fentry->k;
if (k < 0) {
...
} else {
u32 _tmp, *p;
p = skb_header_pointer(skb, k, 4, &_tmp);
if (p != NULL) {
A = ntohl(*p);
continue;
}
}

skb_header_pointer checks if the requested data is within the
linear area:

int hlen = skb_headlen(skb);

if (offset + len <= hlen)
return skb->data + offset;

When offset is within [INT_MAX-len+1..INT_MAX] the addition will
result in a negative number which is <= hlen.

I couldn't trigger a crash on my AMD64 with 2GB of memory, but a
coworker tried on his x86 machine and it crashed immediately.

This patch fixes the check in skb_header_pointer to handle large
positive offsets similar to skb_copy_bits. Invalid data can still
be accessed using negative offsets (also similar to skb_copy_bits),
anyone using negative offsets needs to verify them himself.

Thanks to Thomas Vögtle <thomas.voegtle@coreworks.de> for verifying the
problem by crashing his machine and providing me with an Oops.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
include/linux/skbuff.h | 2 +-
1 files changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.12.3.orig/include/linux/skbuff.h 2005-07-28 11:17:01.000000000 -0700
+++ linux-2.6.12.3/include/linux/skbuff.h 2005-07-28 11:17:12.000000000 -0700
@@ -1192,7 +1192,7 @@
{
int hlen = skb_headlen(skb);

- if (offset + len <= hlen)
+ if (hlen - offset >= len)
return skb->data + offset;

if (skb_copy_bits(skb, offset, buffer, len) < 0)
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
\
 
 \ /
  Last update: 2005-08-03 09:04    [W:0.091 / U:5.368 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site