* [PATCH] net/ipv6: Fix CALIPSO causing GPF with datagram support
@ 2017-06-05 15:44 Richard Haines
2017-06-05 15:55 ` Paul Moore
2017-06-06 19:19 ` David Miller
0 siblings, 2 replies; 5+ messages in thread
From: Richard Haines @ 2017-06-05 15:44 UTC (permalink / raw)
To: linux-security-module
When using CALIPSO with IPPROTO_UDP it is possible to trigger a GPF as the
IP header may have moved.
Also update the payload length after adding the CALIPSO option.
Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
---
net/ipv6/calipso.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
index 37ac9de..8d772fe 100644
--- a/net/ipv6/calipso.c
+++ b/net/ipv6/calipso.c
@@ -1319,7 +1319,7 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
struct ipv6hdr *ip6_hdr;
struct ipv6_opt_hdr *hop;
unsigned char buf[CALIPSO_MAX_BUFFER];
- int len_delta, new_end, pad;
+ int len_delta, new_end, pad, payload;
unsigned int start, end;
ip6_hdr = ipv6_hdr(skb);
@@ -1346,6 +1346,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
if (ret_val < 0)
return ret_val;
+ ip6_hdr = ipv6_hdr(skb); /* Reset as skb_cow() may have moved it */
+
if (len_delta) {
if (len_delta > 0)
skb_push(skb, len_delta);
@@ -1355,6 +1357,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
sizeof(*ip6_hdr) + start);
skb_reset_network_header(skb);
ip6_hdr = ipv6_hdr(skb);
+ payload = ntohs(ip6_hdr->payload_len);
+ ip6_hdr->payload_len = htons(payload + len_delta);
}
hop = (struct ipv6_opt_hdr *)(ip6_hdr + 1);
--
2.9.4
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH] net/ipv6: Fix CALIPSO causing GPF with datagram support
2017-06-05 15:44 [PATCH] net/ipv6: Fix CALIPSO causing GPF with datagram support Richard Haines
@ 2017-06-05 15:55 ` Paul Moore
2017-06-05 16:00 ` David Miller
2017-06-05 17:20 ` Huw Davies
2017-06-06 19:19 ` David Miller
1 sibling, 2 replies; 5+ messages in thread
From: Paul Moore @ 2017-06-05 15:55 UTC (permalink / raw)
To: linux-security-module
On Mon, Jun 5, 2017 at 11:44 AM, Richard Haines
<richard_c_haines@btinternet.com> wrote:
> When using CALIPSO with IPPROTO_UDP it is possible to trigger a GPF as the
> IP header may have moved.
>
> Also update the payload length after adding the CALIPSO option.
>
> Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
> ---
> net/ipv6/calipso.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
Acked-by: Paul Moore <paul@paul-moore.com>
Thanks Richard. DaveM, I assume you'll be pulling this into your tree?
> diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
> index 37ac9de..8d772fe 100644
> --- a/net/ipv6/calipso.c
> +++ b/net/ipv6/calipso.c
> @@ -1319,7 +1319,7 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
> struct ipv6hdr *ip6_hdr;
> struct ipv6_opt_hdr *hop;
> unsigned char buf[CALIPSO_MAX_BUFFER];
> - int len_delta, new_end, pad;
> + int len_delta, new_end, pad, payload;
> unsigned int start, end;
>
> ip6_hdr = ipv6_hdr(skb);
> @@ -1346,6 +1346,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
> if (ret_val < 0)
> return ret_val;
>
> + ip6_hdr = ipv6_hdr(skb); /* Reset as skb_cow() may have moved it */
> +
> if (len_delta) {
> if (len_delta > 0)
> skb_push(skb, len_delta);
> @@ -1355,6 +1357,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
> sizeof(*ip6_hdr) + start);
> skb_reset_network_header(skb);
> ip6_hdr = ipv6_hdr(skb);
> + payload = ntohs(ip6_hdr->payload_len);
> + ip6_hdr->payload_len = htons(payload + len_delta);
> }
>
> hop = (struct ipv6_opt_hdr *)(ip6_hdr + 1);
> --
> 2.9.4
>
--
paul moore
www.paul-moore.com
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH] net/ipv6: Fix CALIPSO causing GPF with datagram support
2017-06-05 15:55 ` Paul Moore
@ 2017-06-05 16:00 ` David Miller
2017-06-05 17:20 ` Huw Davies
1 sibling, 0 replies; 5+ messages in thread
From: David Miller @ 2017-06-05 16:00 UTC (permalink / raw)
To: linux-security-module
From: Paul Moore <paul@paul-moore.com>
Date: Mon, 5 Jun 2017 11:55:34 -0400
> On Mon, Jun 5, 2017 at 11:44 AM, Richard Haines
> <richard_c_haines@btinternet.com> wrote:
>> When using CALIPSO with IPPROTO_UDP it is possible to trigger a GPF as the
>> IP header may have moved.
>>
>> Also update the payload length after adding the CALIPSO option.
>>
>> Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
>> ---
>> net/ipv6/calipso.c | 6 +++++-
>> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> Acked-by: Paul Moore <paul@paul-moore.com>
>
> Thanks Richard. DaveM, I assume you'll be pulling this into your tree?
Sure.
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH] net/ipv6: Fix CALIPSO causing GPF with datagram support
2017-06-05 15:55 ` Paul Moore
2017-06-05 16:00 ` David Miller
@ 2017-06-05 17:20 ` Huw Davies
1 sibling, 0 replies; 5+ messages in thread
From: Huw Davies @ 2017-06-05 17:20 UTC (permalink / raw)
To: linux-security-module
On Mon, Jun 05, 2017 at 11:55:34AM -0400, Paul Moore wrote:
> On Mon, Jun 5, 2017 at 11:44 AM, Richard Haines
> <richard_c_haines@btinternet.com> wrote:
> > When using CALIPSO with IPPROTO_UDP it is possible to trigger a GPF as the
> > IP header may have moved.
> >
> > Also update the payload length after adding the CALIPSO option.
> >
> > Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
> > ---
> > net/ipv6/calipso.c | 6 +++++-
> > 1 file changed, 5 insertions(+), 1 deletion(-)
>
> Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Huw Davies <huw@codeweavers.com>
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH] net/ipv6: Fix CALIPSO causing GPF with datagram support
2017-06-05 15:44 [PATCH] net/ipv6: Fix CALIPSO causing GPF with datagram support Richard Haines
2017-06-05 15:55 ` Paul Moore
@ 2017-06-06 19:19 ` David Miller
1 sibling, 0 replies; 5+ messages in thread
From: David Miller @ 2017-06-06 19:19 UTC (permalink / raw)
To: linux-security-module
From: Richard Haines <richard_c_haines@btinternet.com>
Date: Mon, 5 Jun 2017 16:44:40 +0100
> When using CALIPSO with IPPROTO_UDP it is possible to trigger a GPF as the
> IP header may have moved.
>
> Also update the payload length after adding the CALIPSO option.
>
> Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
Applied and queued up for -stable, thank you Richard.
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2017-06-06 19:19 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-06-05 15:44 [PATCH] net/ipv6: Fix CALIPSO causing GPF with datagram support Richard Haines
2017-06-05 15:55 ` Paul Moore
2017-06-05 16:00 ` David Miller
2017-06-05 17:20 ` Huw Davies
2017-06-06 19:19 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).