* [PATCH 1/2] xfrm4: fix the ports decode of sctp protocol
@ 2009-07-03 2:57 Wei Yongjun
2009-07-03 2:59 ` [PATCH 2/2] xfrm6: fix the proto and " Wei Yongjun
2009-07-03 3:48 ` [PATCH 1/2] xfrm4: fix the " Herbert Xu
0 siblings, 2 replies; 6+ messages in thread
From: Wei Yongjun @ 2009-07-03 2:57 UTC (permalink / raw)
To: Herbert Xu, David Miller; +Cc: Netdev
The SCTP pushed the skb data above the sctp chunk header, so the check
of pskb_may_pull(skb, xprth + 4 - skb->data) in _decode_session4() will
never return 0 because xprth + 4 - skb->data < 0, the ports decode of
sctp will always fail.
Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
---
net/ipv4/xfrm4_policy.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 60d918c..0071ee6 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -136,7 +136,8 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
case IPPROTO_TCP:
case IPPROTO_SCTP:
case IPPROTO_DCCP:
- if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
+ if (xprth + 4 < skb->data ||
+ pskb_may_pull(skb, xprth + 4 - skb->data)) {
__be16 *ports = (__be16 *)xprth;
fl->fl_ip_sport = ports[!!reverse];
--
1.6.2.2
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/2] xfrm6: fix the proto and ports decode of sctp protocol
2009-07-03 2:57 [PATCH 1/2] xfrm4: fix the ports decode of sctp protocol Wei Yongjun
@ 2009-07-03 2:59 ` Wei Yongjun
2009-07-03 3:49 ` Herbert Xu
2009-07-03 3:48 ` [PATCH 1/2] xfrm4: fix the " Herbert Xu
1 sibling, 1 reply; 6+ messages in thread
From: Wei Yongjun @ 2009-07-03 2:59 UTC (permalink / raw)
To: Herbert Xu, David Miller; +Cc: Netdev
The SCTP pushed the skb above the sctp chunk header, so the
check of pskb_may_pull(skb, nh + offset + 1 - skb->data) in
_decode_session6() will never return 0 and the ports decode
of sctp will always fail. (nh + offset + 1 - skb->data < 0)
Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
---
net/ipv6/xfrm6_policy.c | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index b4b16a4..3a3c677 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -157,7 +157,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
ipv6_addr_copy(&fl->fl6_dst, reverse ? &hdr->saddr : &hdr->daddr);
ipv6_addr_copy(&fl->fl6_src, reverse ? &hdr->daddr : &hdr->saddr);
- while (pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
+ while (nh + offset + 1 < skb->data ||
+ pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
nh = skb_network_header(skb);
exthdr = (struct ipv6_opt_hdr *)(nh + offset);
@@ -177,7 +178,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
case IPPROTO_TCP:
case IPPROTO_SCTP:
case IPPROTO_DCCP:
- if (!onlyproto && pskb_may_pull(skb, nh + offset + 4 - skb->data)) {
+ if (!onlyproto && (nh + offset + 4 < skb->data ||
+ pskb_may_pull(skb, nh + offset + 4 - skb->data))) {
__be16 *ports = (__be16 *)exthdr;
fl->fl_ip_sport = ports[!!reverse];
--
1.6.2.2
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] xfrm4: fix the ports decode of sctp protocol
2009-07-03 2:57 [PATCH 1/2] xfrm4: fix the ports decode of sctp protocol Wei Yongjun
2009-07-03 2:59 ` [PATCH 2/2] xfrm6: fix the proto and " Wei Yongjun
@ 2009-07-03 3:48 ` Herbert Xu
2009-07-04 2:10 ` David Miller
1 sibling, 1 reply; 6+ messages in thread
From: Herbert Xu @ 2009-07-03 3:48 UTC (permalink / raw)
To: Wei Yongjun; +Cc: David Miller, Netdev, Vlad Yasevich
On Fri, Jul 03, 2009 at 10:57:23AM +0800, Wei Yongjun wrote:
> The SCTP pushed the skb data above the sctp chunk header, so the check
> of pskb_may_pull(skb, xprth + 4 - skb->data) in _decode_session4() will
> never return 0 because xprth + 4 - skb->data < 0, the ports decode of
> sctp will always fail.
>
> Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Longer term I wonder if we can move this stuff into the protocol
code, i.e., before they call xfrm_policy_check.
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 2/2] xfrm6: fix the proto and ports decode of sctp protocol
2009-07-03 2:59 ` [PATCH 2/2] xfrm6: fix the proto and " Wei Yongjun
@ 2009-07-03 3:49 ` Herbert Xu
2009-07-04 2:11 ` David Miller
0 siblings, 1 reply; 6+ messages in thread
From: Herbert Xu @ 2009-07-03 3:49 UTC (permalink / raw)
To: Wei Yongjun; +Cc: David Miller, Netdev, Vlad Yasevich
On Fri, Jul 03, 2009 at 10:59:49AM +0800, Wei Yongjun wrote:
> The SCTP pushed the skb above the sctp chunk header, so the
> check of pskb_may_pull(skb, nh + offset + 1 - skb->data) in
> _decode_session6() will never return 0 and the ports decode
> of sctp will always fail. (nh + offset + 1 - skb->data < 0)
>
> Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] xfrm4: fix the ports decode of sctp protocol
2009-07-03 3:48 ` [PATCH 1/2] xfrm4: fix the " Herbert Xu
@ 2009-07-04 2:10 ` David Miller
0 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2009-07-04 2:10 UTC (permalink / raw)
To: herbert; +Cc: yjwei, netdev, vladislav.yasevich
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Fri, 3 Jul 2009 11:48:49 +0800
> On Fri, Jul 03, 2009 at 10:57:23AM +0800, Wei Yongjun wrote:
>> The SCTP pushed the skb data above the sctp chunk header, so the check
>> of pskb_may_pull(skb, xprth + 4 - skb->data) in _decode_session4() will
>> never return 0 because xprth + 4 - skb->data < 0, the ports decode of
>> sctp will always fail.
>>
>> Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
>
> Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Applied.
> Longer term I wonder if we can move this stuff into the protocol
> code, i.e., before they call xfrm_policy_check.
That ought to work.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 2/2] xfrm6: fix the proto and ports decode of sctp protocol
2009-07-03 3:49 ` Herbert Xu
@ 2009-07-04 2:11 ` David Miller
0 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2009-07-04 2:11 UTC (permalink / raw)
To: herbert; +Cc: yjwei, netdev, vladislav.yasevich
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Fri, 3 Jul 2009 11:49:17 +0800
> On Fri, Jul 03, 2009 at 10:59:49AM +0800, Wei Yongjun wrote:
>> The SCTP pushed the skb above the sctp chunk header, so the
>> check of pskb_may_pull(skb, nh + offset + 1 - skb->data) in
>> _decode_session6() will never return 0 and the ports decode
>> of sctp will always fail. (nh + offset + 1 - skb->data < 0)
>>
>> Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
>
> Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Applied.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2009-07-04 2:11 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-07-03 2:57 [PATCH 1/2] xfrm4: fix the ports decode of sctp protocol Wei Yongjun
2009-07-03 2:59 ` [PATCH 2/2] xfrm6: fix the proto and " Wei Yongjun
2009-07-03 3:49 ` Herbert Xu
2009-07-04 2:11 ` David Miller
2009-07-03 3:48 ` [PATCH 1/2] xfrm4: fix the " Herbert Xu
2009-07-04 2:10 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).