[05/13] [NET]: Fix signedness issues in net/core/filter.c

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


-stable review patch.  If anyone has any objections, please let us know.


This is the code to load packet data into a register:

                        k = fentry->k;
                        if (k < 0) {
                        } else {
                                u32 _tmp, *p;
                                p = skb_header_pointer(skb, k, 4, &_tmp);
                                if (p != NULL) {
                                        A = ntohl(*p);

skb_header_pointer checks if the requested data is within the
linear area:

        int hlen = skb_headlen(skb);

        if (offset + len <= hlen)
                return skb->data + offset;

When offset is within [INT_MAX-len+1..INT_MAX] the addition will
result in a negative number which is <= hlen.

I couldn't trigger a crash on my AMD64 with 2GB of memory, but a
coworker tried on his x86 machine and it crashed immediately.

This patch fixes the check in skb_header_pointer to handle large
positive offsets similar to skb_copy_bits. Invalid data can still
be accessed using negative offsets (also similar to skb_copy_bits),
anyone using negative offsets needs to verify them himself.

Thanks to Thomas Vögtle <[email protected]> for verifying the
problem by crashing his machine and providing me with an Oops.

Signed-off-by: Patrick McHardy <[email protected]>
Signed-off-by: Chris Wright <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
 include/linux/skbuff.h |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

--- linux-	2005-07-28 11:17:01.000000000 -0700
+++ linux-	2005-07-28 11:17:12.000000000 -0700
@@ -1192,7 +1192,7 @@
 	int hlen = skb_headlen(skb);
-	if (offset + len <= hlen)
+	if (hlen - offset >= len)
 		return skb->data + offset;
 	if (skb_copy_bits(skb, offset, buffer, len) < 0)
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[Index of Archives]     [Kernel Newbies]     [Netfilter]     [Bugtraq]     [Photo]     [Gimp]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Video 4 Linux]     [Linux for the blind]
  Powered by Linux