* [patch] net/key/af_key.c: add range checks on ->sadb_x_policy_len
@ 2012-09-28 8:21 Dan Carpenter
2012-10-01 21:15 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2012-09-28 8:21 UTC (permalink / raw)
To: David S. Miller
Cc: Eric W. Biederman, Eric Dumazet, Stephen Hemminger, netdev,
kernel-janitors
Because sizeof() is size_t then if "len" is negative, it counts as a
large positive value.
The call tree looks like:
pfkey_sendmsg()
-> pfkey_process()
-> pfkey_spdadd()
-> parse_ipsecrequests()
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
This is a static checker fix. I'm not very familiar with this code.
I think if we were to hit this then we would try to parse invalid data
and it would return -EINVAL or similar error code pretty quickly.
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 2ca7d7f..7714df0 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1923,6 +1923,9 @@ parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol)
int len = pol->sadb_x_policy_len*8 - sizeof(struct sadb_x_policy);
struct sadb_x_ipsecrequest *rq = (void*)(pol+1);
+ if (pol->sadb_x_policy_len * 8 < sizeof(struct sadb_x_policy))
+ return -EINVAL;
+
while (len >= sizeof(struct sadb_x_ipsecrequest)) {
if ((err = parse_ipsecrequest(xp, rq)) < 0)
return err;
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [patch] net/key/af_key.c: add range checks on ->sadb_x_policy_len
2012-09-28 8:21 [patch] net/key/af_key.c: add range checks on ->sadb_x_policy_len Dan Carpenter
@ 2012-10-01 21:15 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2012-10-01 21:15 UTC (permalink / raw)
To: dan.carpenter; +Cc: ebiederm, eric.dumazet, shemminger, netdev, kernel-janitors
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 28 Sep 2012 11:21:19 +0300
> Because sizeof() is size_t then if "len" is negative, it counts as a
> large positive value.
>
> The call tree looks like:
> pfkey_sendmsg()
> -> pfkey_process()
> -> pfkey_spdadd()
> -> parse_ipsecrequests()
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> This is a static checker fix. I'm not very familiar with this code.
> I think if we were to hit this then we would try to parse invalid data
> and it would return -EINVAL or similar error code pretty quickly.
Applied and queued up for -stable, thanks Dan.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-10-01 21:15 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-09-28 8:21 [patch] net/key/af_key.c: add range checks on ->sadb_x_policy_len Dan Carpenter
2012-10-01 21:15 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).