* [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() @ 2015-10-14 17:51 Ben Hutchings 2015-10-14 17:53 ` [PATCH 2/2] ppp, slip: Validate VJ compression slot parameters completely Ben Hutchings 2015-10-16 7:46 ` [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() David Miller 0 siblings, 2 replies; 6+ messages in thread From: Ben Hutchings @ 2015-10-14 17:51 UTC (permalink / raw) To: David Miller; +Cc: Karsten Keil, linux-ppp, netdev [-- Attachment #1: Type: text/plain, Size: 1166 bytes --] Compile-tested only. Signed-off-by: Ben Hutchings <ben@decadent.org.uk> --- drivers/isdn/i4l/isdn_ppp.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c index c4198fa..86f9abe 100644 --- a/drivers/isdn/i4l/isdn_ppp.c +++ b/drivers/isdn/i4l/isdn_ppp.c @@ -301,6 +301,8 @@ isdn_ppp_open(int min, struct file *file) is->compflags = 0; is->reset = isdn_ppp_ccp_reset_alloc(is); + if (!is->reset) + return -ENOMEM; is->lp = NULL; is->mp_seqno = 0; /* MP sequence number */ @@ -320,6 +322,10 @@ isdn_ppp_open(int min, struct file *file) * VJ header compression init */ is->slcomp = slhc_init(16, 16); /* not necessary for 2. link in bundle */ + if (!is->slcomp) { + isdn_ppp_ccp_reset_free(is); + return -ENOMEM; + } #endif #ifdef CONFIG_IPPP_FILTER is->pass_filter = NULL; -- Ben Hutchings [W]e found...that it wasn't as easy to get programs right as we had thought. ... I realized that a large part of my life from then on was going to be spent in finding mistakes in my own programs. - Maurice Wilkes, 1949 [-- Attachment #2: This is a digitally signed message part --] [-- Type: application/pgp-signature, Size: 811 bytes --] ^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/2] ppp, slip: Validate VJ compression slot parameters completely 2015-10-14 17:51 [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() Ben Hutchings @ 2015-10-14 17:53 ` Ben Hutchings 2015-10-16 7:46 ` [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() David Miller 1 sibling, 0 replies; 6+ messages in thread From: Ben Hutchings @ 2015-10-14 17:53 UTC (permalink / raw) To: David Miller; +Cc: Karsten Keil, linux-ppp, netdev, 郭永刚 [-- Attachment #1: Type: text/plain, Size: 4500 bytes --] Currently slhc_init() treats out-of-range values of rslots and tslots as equivalent to 0, except that if tslots is too large it will dereference a null pointer (CVE-2015-7799). Add a range-check at the top of the function and make it return an ERR_PTR() on error instead of NULL. Change the callers accordingly. Compile-tested only. Reported-by: 郭永刚 <guoyonggang@360.cn> References: http://article.gmane.org/gmane.comp.security.oss.general/17908 Signed-off-by: Ben Hutchings <ben@decadent.org.uk> --- drivers/isdn/i4l/isdn_ppp.c | 10 ++++------ drivers/net/ppp/ppp_generic.c | 6 ++---- drivers/net/slip/slhc.c | 12 ++++++++---- drivers/net/slip/slip.c | 2 +- 4 files changed, 15 insertions(+), 15 deletions(-) diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c index 86f9abe..9c1e8ad 100644 --- a/drivers/isdn/i4l/isdn_ppp.c +++ b/drivers/isdn/i4l/isdn_ppp.c @@ -322,9 +322,9 @@ isdn_ppp_open(int min, struct file *file) * VJ header compression init */ is->slcomp = slhc_init(16, 16); /* not necessary for 2. link in bundle */ - if (!is->slcomp) { + if (IS_ERR(is->slcomp)) { isdn_ppp_ccp_reset_free(is); - return -ENOMEM; + return PTR_ERR(is->slcomp); } #endif #ifdef CONFIG_IPPP_FILTER @@ -573,10 +573,8 @@ isdn_ppp_ioctl(int min, struct file *file, unsigned int cmd, unsigned long arg) is->maxcid = val; #ifdef CONFIG_ISDN_PPP_VJ sltmp = slhc_init(16, val); - if (!sltmp) { - printk(KERN_ERR "ippp, can't realloc slhc struct\n"); - return -ENOMEM; - } + if (IS_ERR(sltmp)) + return PTR_ERR(sltmp); if (is->slcomp) slhc_free(is->slcomp); is->slcomp = sltmp; diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c index ed00446..9a863c6 100644 --- a/drivers/net/ppp/ppp_generic.c +++ b/drivers/net/ppp/ppp_generic.c @@ -721,10 +721,8 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) val &= 0xffff; } vj = slhc_init(val2+1, val+1); - if (!vj) { - netdev_err(ppp->dev, - "PPP: no memory (VJ compressor)\n"); - err = -ENOMEM; + if (IS_ERR(vj)) { + err = PTR_ERR(vj); break; } ppp_lock(ppp); diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c index 079f7ad..27ed252 100644 --- a/drivers/net/slip/slhc.c +++ b/drivers/net/slip/slhc.c @@ -84,8 +84,9 @@ static long decode(unsigned char **cpp); static unsigned char * put16(unsigned char *cp, unsigned short x); static unsigned short pull16(unsigned char **cpp); -/* Initialize compression data structure +/* Allocate compression data structure * slots must be in range 0 to 255 (zero meaning no compression) + * Returns pointer to structure or ERR_PTR() on error. */ struct slcompress * slhc_init(int rslots, int tslots) @@ -94,11 +95,14 @@ slhc_init(int rslots, int tslots) register struct cstate *ts; struct slcompress *comp; + if (rslots < 0 || rslots > 255 || tslots < 0 || tslots > 255) + return ERR_PTR(-EINVAL); + comp = kzalloc(sizeof(struct slcompress), GFP_KERNEL); if (! comp) goto out_fail; - if ( rslots > 0 && rslots < 256 ) { + if (rslots > 0) { size_t rsize = rslots * sizeof(struct cstate); comp->rstate = kzalloc(rsize, GFP_KERNEL); if (! comp->rstate) @@ -106,7 +110,7 @@ slhc_init(int rslots, int tslots) comp->rslot_limit = rslots - 1; } - if ( tslots > 0 && tslots < 256 ) { + if (tslots > 0) { size_t tsize = tslots * sizeof(struct cstate); comp->tstate = kzalloc(tsize, GFP_KERNEL); if (! comp->tstate) @@ -141,7 +145,7 @@ out_free2: out_free: kfree(comp); out_fail: - return NULL; + return ERR_PTR(-ENOMEM); } diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c index 05387b1..a17d86a 100644 --- a/drivers/net/slip/slip.c +++ b/drivers/net/slip/slip.c @@ -164,7 +164,7 @@ static int sl_alloc_bufs(struct slip *sl, int mtu) if (cbuff == NULL) goto err_exit; slcomp = slhc_init(16, 16); - if (slcomp == NULL) + if (IS_ERR(slcomp)) goto err_exit; #endif spin_lock_bh(&sl->lock); -- Ben Hutchings [W]e found...that it wasn't as easy to get programs right as we had thought. ... I realized that a large part of my life from then on was going to be spent in finding mistakes in my own programs. - Maurice Wilkes, 1949 [-- Attachment #2: This is a digitally signed message part --] [-- Type: application/pgp-signature, Size: 811 bytes --] ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() 2015-10-14 17:51 [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() Ben Hutchings 2015-10-14 17:53 ` [PATCH 2/2] ppp, slip: Validate VJ compression slot parameters completely Ben Hutchings @ 2015-10-16 7:46 ` David Miller 2015-10-30 13:03 ` Josh Boyer 2015-11-01 16:23 ` Ben Hutchings 1 sibling, 2 replies; 6+ messages in thread From: David Miller @ 2015-10-16 7:46 UTC (permalink / raw) To: ben; +Cc: isdn, linux-ppp, netdev From: Ben Hutchings <ben@decadent.org.uk> Date: Wed, 14 Oct 2015 18:51:14 +0100 > Compile-tested only. > > Signed-off-by: Ben Hutchings <ben@decadent.org.uk> > --- > drivers/isdn/i4l/isdn_ppp.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c > index c4198fa..86f9abe 100644 > --- a/drivers/isdn/i4l/isdn_ppp.c > +++ b/drivers/isdn/i4l/isdn_ppp.c > @@ -301,6 +301,8 @@ isdn_ppp_open(int min, struct file *file) > is->compflags = 0; > > is->reset = isdn_ppp_ccp_reset_alloc(is); > + if (!is->reset) > + return -ENOMEM; Ben, your email client has corrupted both of these patches. Please fix this up and resubmit, thanks. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() 2015-10-16 7:46 ` [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() David Miller @ 2015-10-30 13:03 ` Josh Boyer 2015-11-01 16:23 ` Ben Hutchings 2015-11-01 16:23 ` Ben Hutchings 1 sibling, 1 reply; 6+ messages in thread From: Josh Boyer @ 2015-10-30 13:03 UTC (permalink / raw) To: Ben Hutchings; +Cc: isdn, David Miller, linux-ppp, netdev On Fri, Oct 16, 2015 at 3:46 AM, David Miller <davem@davemloft.net> wrote: > From: Ben Hutchings <ben@decadent.org.uk> > Date: Wed, 14 Oct 2015 18:51:14 +0100 > >> Compile-tested only. >> >> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> >> --- >> drivers/isdn/i4l/isdn_ppp.c | 6 ++++++ >> 1 file changed, 6 insertions(+) >> >> diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c >> index c4198fa..86f9abe 100644 >> --- a/drivers/isdn/i4l/isdn_ppp.c >> +++ b/drivers/isdn/i4l/isdn_ppp.c >> @@ -301,6 +301,8 @@ isdn_ppp_open(int min, struct file *file) >> is->compflags = 0; >> >> is->reset = isdn_ppp_ccp_reset_alloc(is); >> + if (!is->reset) >> + return -ENOMEM; > > Ben, your email client has corrupted both of these patches. > > Please fix this up and resubmit, thanks. Ben, did you resubmit these as David suggested? I haven't found a v2 anywhere. josh ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() 2015-10-30 13:03 ` Josh Boyer @ 2015-11-01 16:23 ` Ben Hutchings 0 siblings, 0 replies; 6+ messages in thread From: Ben Hutchings @ 2015-11-01 16:23 UTC (permalink / raw) To: Josh Boyer; +Cc: isdn, David Miller, linux-ppp, netdev [-- Attachment #1: Type: text/plain, Size: 1239 bytes --] On Fri, 2015-10-30 at 09:03 -0400, Josh Boyer wrote: > On Fri, Oct 16, 2015 at 3:46 AM, David Miller <davem@davemloft.net> > wrote: > > From: Ben Hutchings <ben@decadent.org.uk> > > Date: Wed, 14 Oct 2015 18:51:14 +0100 > > > > > Compile-tested only. > > > > > > Signed-off-by: Ben Hutchings <ben@decadent.org.uk> > > > --- > > > drivers/isdn/i4l/isdn_ppp.c | 6 ++++++ > > > 1 file changed, 6 insertions(+) > > > > > > diff --git a/drivers/isdn/i4l/isdn_ppp.c > > > b/drivers/isdn/i4l/isdn_ppp.c > > > index c4198fa..86f9abe 100644 > > > --- a/drivers/isdn/i4l/isdn_ppp.c > > > +++ b/drivers/isdn/i4l/isdn_ppp.c > > > @@ -301,6 +301,8 @@ isdn_ppp_open(int min, struct file *file) > > > is->compflags = 0; > > > > > > is->reset = isdn_ppp_ccp_reset_alloc(is); > > > + if (!is->reset) > > > + return -ENOMEM; > > > > Ben, your email client has corrupted both of these patches. > > > > Please fix this up and resubmit, thanks. > > Ben, did you resubmit these as David suggested? I haven't found a v2 > anywhere. I've just done so. Ben. -- Ben Hutchings Nothing is ever a complete failure; it can always serve as a bad example. [-- Attachment #2: This is a digitally signed message part --] [-- Type: application/pgp-signature, Size: 811 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() 2015-10-16 7:46 ` [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() David Miller 2015-10-30 13:03 ` Josh Boyer @ 2015-11-01 16:23 ` Ben Hutchings 1 sibling, 0 replies; 6+ messages in thread From: Ben Hutchings @ 2015-11-01 16:23 UTC (permalink / raw) To: David Miller; +Cc: isdn, linux-ppp, netdev [-- Attachment #1: Type: text/plain, Size: 1055 bytes --] On Fri, 2015-10-16 at 00:46 -0700, David Miller wrote: > From: Ben Hutchings <ben@decadent.org.uk> > Date: Wed, 14 Oct 2015 18:51:14 +0100 > > > Compile-tested only. > > > > Signed-off-by: Ben Hutchings <ben@decadent.org.uk> > > --- > > drivers/isdn/i4l/isdn_ppp.c | 6 ++++++ > > 1 file changed, 6 insertions(+) > > > > diff --git a/drivers/isdn/i4l/isdn_ppp.c > b/drivers/isdn/i4l/isdn_ppp.c > > index c4198fa..86f9abe 100644 > > --- a/drivers/isdn/i4l/isdn_ppp.c > > +++ b/drivers/isdn/i4l/isdn_ppp.c > > @@ -301,6 +301,8 @@ isdn_ppp_open(int min, struct file *file) > > is->compflags = 0; > > > > is->reset = isdn_ppp_ccp_reset_alloc(is); > > + if (!is->reset) > > + return -ENOMEM; > > Ben, your email client has corrupted both of these patches. > > Please fix this up and resubmit, thanks. Sorry about that; it is a regression in Evolution 3.18. Ben. -- Ben Hutchings Nothing is ever a complete failure; it can always serve as a bad example. [-- Attachment #2: This is a digitally signed message part --] [-- Type: application/pgp-signature, Size: 811 bytes --] ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2015-11-01 16:23 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2015-10-14 17:51 [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() Ben Hutchings 2015-10-14 17:53 ` [PATCH 2/2] ppp, slip: Validate VJ compression slot parameters completely Ben Hutchings 2015-10-16 7:46 ` [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() David Miller 2015-10-30 13:03 ` Josh Boyer 2015-11-01 16:23 ` Ben Hutchings 2015-11-01 16:23 ` Ben Hutchings
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox