lkml.org 
[lkml]   [2017]   [Jan]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 04/59] inet: fix IP(V6)_RECVORIGDSTADDR for udp sockets
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Willem de Bruijn <willemb@google.com>


    [ Upstream commit 39b2dd765e0711e1efd1d1df089473a8dd93ad48 ]

    Socket cmsg IP(V6)_RECVORIGDSTADDR checks that port range lies within
    the packet. For sockets that have transport headers pulled, transport
    offset can be negative. Use signed comparison to avoid overflow.

    Fixes: e6afc8ace6dd ("udp: remove headers from UDP packets before queueing")
    Reported-by: Nisar Jagabar <njagabar@cloudmark.com>
    Signed-off-by: Willem de Bruijn <willemb@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/ipv4/ip_sockglue.c | 2 +-
    net/ipv6/datagram.c | 2 +-
    2 files changed, 2 insertions(+), 2 deletions(-)

    --- a/net/ipv4/ip_sockglue.c
    +++ b/net/ipv4/ip_sockglue.c
    @@ -137,7 +137,7 @@ static void ip_cmsg_recv_dstaddr(struct
    const struct iphdr *iph = ip_hdr(skb);
    __be16 *ports = (__be16 *)skb_transport_header(skb);

    - if (skb_transport_offset(skb) + 4 > skb->len)
    + if (skb_transport_offset(skb) + 4 > (int)skb->len)
    return;

    /* All current transport protocols have the port numbers in the
    --- a/net/ipv6/datagram.c
    +++ b/net/ipv6/datagram.c
    @@ -700,7 +700,7 @@ void ip6_datagram_recv_specific_ctl(stru
    struct sockaddr_in6 sin6;
    __be16 *ports = (__be16 *) skb_transport_header(skb);

    - if (skb_transport_offset(skb) + 4 <= skb->len) {
    + if (skb_transport_offset(skb) + 4 <= (int)skb->len) {
    /* All current transport protocols have the port numbers in the
    * first four bytes of the transport header and this function is
    * written with this assumption in mind.

    \
     
     \ /
      Last update: 2017-01-13 13:15    [W:5.301 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site