From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5134579E5; Sat, 13 Jan 2024 20:41:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="qn4xslFV" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 62DA4C433F1; Sat, 13 Jan 2024 20:40:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1705178460; bh=c8BIQyP1H8lJObZSyl18dvJBZNh2pJY7zSNOX401RyQ=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=qn4xslFVH3tcADj40i6pWVh6bZyn8WaSie6SIWR0WkQSXBtyJJJ9lUMuUJctrEXxM J0orl6gEIo61FRKwl2wq+Rbruo4hrelO5oD7OBsjGXsefe3ku26FyKy7gqh5Y8jVqL R9gRghwdeQRGyixCVKKVnaDGR78+pekJu6fwIn/LsY36kaLkWImdmUk4zAG5/ubgqI 4pMqhjNxXMJsVoXEoD+EnZR7GoNBihD93TeMJyvvcCalZynDqiKmfTumxdEVJDZYVZ kB0uLDJ3o6Y4PgZcqvm77scHlMb2HGwUlkOirDnNc2N51LyKAyF4FU54Ow9cbZD61/ Pcw6rICC9g1wg== Precedence: bulk X-Mailing-List: linux-fsdevel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Sat, 13 Jan 2024 22:40:54 +0200 Message-Id: From: "Jarkko Sakkinen" To: "David Howells" , "Linus Torvalds" , "Edward Adam Davis" , "Pengfei Xu" Cc: "Simon Horman" , "Markus Suvanto" , "Jeffrey E Altman" , "Marc Dionne" , "Wang Lei" , "Jeff Layton" , "Steve French" , "David S. Miller" , "Eric Dumazet" , "Jakub Kicinski" , "Paolo Abeni" , , , , , , , , Subject: Re: [PATCH] keys, dns: Fix size check of V1 server-list header X-Mailer: aerc 0.16.0 References: <1850031.1704921100@warthog.procyon.org.uk> In-Reply-To: <1850031.1704921100@warthog.procyon.org.uk> On Wed Jan 10, 2024 at 11:11 PM EET, David Howells wrote: > =20 > Fix the size check added to dns_resolver_preparse() for the V1 server-lis= t > header so that it doesn't give EINVAL if the size supplied is the same as > the size of the header struct (which should be valid). > > This can be tested with: > > echo -n -e '\0\0\01\xff\0\0' | keyctl padd dns_resolver desc @p > > which will give "add_key: Invalid argument" without this fix. > > Fixes: 1997b3cb4217 ("keys, dns: Fix missing size check of V1 server-list= header") > Reported-by: Pengfei Xu > Link: https://lore.kernel.org/r/ZZ4fyY4r3rqgZL+4@xpf.sh.intel.com/ > Signed-off-by: David Howells > cc: Edward Adam Davis > cc: Linus Torvalds > cc: Simon Horman > Cc: Jarkko Sakkinen > Cc: Jeffrey E Altman > Cc: Wang Lei > Cc: Jeff Layton > Cc: Steve French > Cc: Marc Dionne > Cc: "David S. Miller" > Cc: Eric Dumazet > Cc: Jakub Kicinski > Cc: Paolo Abeni > --- > net/dns_resolver/dns_key.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c > index f18ca02aa95a..c42ddd85ff1f 100644 > --- a/net/dns_resolver/dns_key.c > +++ b/net/dns_resolver/dns_key.c > @@ -104,7 +104,7 @@ dns_resolver_preparse(struct key_preparsed_payload *p= rep) > const struct dns_server_list_v1_header *v1; > =20 > /* It may be a server list. */ > - if (datalen <=3D sizeof(*v1)) > + if (datalen < sizeof(*v1)) > return -EINVAL; > =20 > v1 =3D (const struct dns_server_list_v1_header *)data; Reviewed-by: Jarkko Sakkinen BR, Jarkko