From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754697Ab3KCWSb (ORCPT ); Sun, 3 Nov 2013 17:18:31 -0500 Received: from mx1.redhat.com ([209.132.183.28]:56869 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752987Ab3KCWS3 (ORCPT ); Sun, 3 Nov 2013 17:18:29 -0500 Message-ID: <5276CBAE.8010301@redhat.com> Date: Sun, 03 Nov 2013 23:18:22 +0100 From: Daniel Borkmann User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130805 Thunderbird/17.0.8 MIME-Version: 1.0 To: Jason Wang CC: davem@davemloft.net, edumazet@google.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Petr Matousek , "Michael S. Tsirkin" Subject: Re: [PATCH net] net: flow_dissector: fail on evil iph->ihl References: <1383289270-18952-1-git-send-email-jasowang@redhat.com> In-Reply-To: <1383289270-18952-1-git-send-email-jasowang@redhat.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 11/01/2013 08:01 AM, Jason Wang wrote: > We don't validate iph->ihl which may lead a dead loop if we meet a IPIP > skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl > is evil (less than 5). > > This issue were introduced by commit ec5efe7946280d1e84603389a1030ccec0a767ae > (rps: support IPIP encapsulation). > > Cc: Eric Dumazet > Cc: Petr Matousek > Cc: Michael S. Tsirkin > Cc: Daniel Borkmann > Signed-off-by: Jason Wang Sorry, a bit late as I was offline last 4 days, but fwiw: Acked-by: Daniel Borkmann