Re: [PATCH net v2 2/3] mptcp: Fix out of bounds when parsing TCP options

[Mat Martineau <mathew.j.martineau@linux.intel.com>]

On Thu, 10 Jun 2021, Maxim Mikityanskiy wrote:

> The TCP option parser in mptcp (mptcp_get_options) could read one byte
> out of bounds. When the length is 1, the execution flow gets into the
> loop, reads one byte of the opcode, and if the opcode is neither
> TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the
> length of 1.
>
> This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stack
> out of bounds when parsing TCP options.").
>
> Cc: Young Xiao <92siuyang@gmail.com>
> Fixes: cec37a6e41aa ("mptcp: Handle MP_CAPABLE options for outgoing connections")
> Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
> Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
> ---
> net/mptcp/options.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/net/mptcp/options.c b/net/mptcp/options.c
> index 6b825fb3fa83..9b263f27ce9b 100644
> --- a/net/mptcp/options.c
> +++ b/net/mptcp/options.c
> @@ -356,6 +356,8 @@ void mptcp_get_options(const struct sk_buff *skb,
> 			length--;
> 			continue;
> 		default:
> +			if (length < 2)
> +				return;
> 			opsize = *ptr++;
> 			if (opsize < 2) /* "silly options" */
> 				return;
> -- 
> 2.25.1

Matthieu -

Could you apply this in mptcp_net-next so it's easier to track when the 
patch finds its way to net-next?

(MPTCP patchwork status set to "queued")

Thanks!

--
Mat Martineau
Intel