[PATCH] Cipso: cipso_v4_optptr enter infinite loop

netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed

* [PATCH] Cipso: cipso_v4_optptr enter infinite loop
@ 2017-07-31  3:23 Yujuan Qi
  2017-07-31 20:13 ` Paul Moore
  2017-08-01 22:31 ` David Miller
  0 siblings, 2 replies; 5+ messages in thread
From: Yujuan Qi @ 2017-07-31  3:23 UTC (permalink / raw)
  To: Paul Moore, David S. Miller
  Cc: Ryder Lee, yujuan.qi, netdev-u79uwXL29TY76Z2rM5mHXA,
	linux-kernel-u79uwXL29TY76Z2rM5mHXA,
	linux-mediatek-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r, Casey Schaufler

From: "yujuan.qi" <yujuan.qi-NuS5LvNUpcJWk0Htik3J/w@public.gmane.org>

in for(),if((optlen > 0) && (optptr[1] == 0)), enter infinite loop.

Test: receive a packet which the ip length > 20 and the first byte of ip option is 0, produce this issue

Signed-off-by: yujuan.qi <yujuan.qi-NuS5LvNUpcJWk0Htik3J/w@public.gmane.org>
---
 net/ipv4/cipso_ipv4.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index ae20616..0d1e07d 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1523,9 +1523,17 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
 	int taglen;
 
 	for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
-		if (optptr[0] == IPOPT_CIPSO)
+		switch (optptr[0]) {
+		case IPOPT_CIPSO:
 			return optptr;
-		taglen = optptr[1];
+		case IPOPT_END:
+			return NULL;
+		case IPOPT_NOOP:
+			taglen = 1;
+			break;
+		default:
+			taglen = optptr[1];
+		}
 		optlen -= taglen;
 		optptr += taglen;
 	}
-- 
1.9.1

^ permalink raw reply related	[flat|nested] 5+ messages in thread

* Re: [PATCH] Cipso: cipso_v4_optptr enter infinite loop
  2017-07-31  3:23 [PATCH] Cipso: cipso_v4_optptr enter infinite loop Yujuan Qi
@ 2017-07-31 20:13 ` Paul Moore
       [not found]   ` <CAGH-KguiiVTyxHp0Z3Z==6b5n2h3Lm4SmU=ruydMpGgctdhYSw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
  2017-08-01 22:31 ` David Miller
  1 sibling, 1 reply; 5+ messages in thread
From: Paul Moore @ 2017-07-31 20:13 UTC (permalink / raw)
  To: Yujuan Qi
  Cc: David S. Miller, Casey Schaufler, netdev, linux-mediatek,
	linux-kernel, Ryder Lee

On Sun, Jul 30, 2017 at 11:23 PM, Yujuan Qi <yujuan.qi@mediatek.com> wrote:
> From: "yujuan.qi" <yujuan.qi@mediatek.com>
>
> in for(),if((optlen > 0) && (optptr[1] == 0)), enter infinite loop.
>
> Test: receive a packet which the ip length > 20 and the first byte of ip option is 0, produce this issue
>
> Signed-off-by: yujuan.qi <yujuan.qi@mediatek.com>
> ---
>  net/ipv4/cipso_ipv4.c | 12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)

Considering I gave you the code below I should probably ack it, right? ;)

Acked-by: Paul Moore <paul@paul-moore.com>

> diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
> index ae20616..0d1e07d 100644
> --- a/net/ipv4/cipso_ipv4.c
> +++ b/net/ipv4/cipso_ipv4.c
> @@ -1523,9 +1523,17 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
>         int taglen;
>
>         for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
> -               if (optptr[0] == IPOPT_CIPSO)
> +               switch (optptr[0]) {
> +               case IPOPT_CIPSO:
>                         return optptr;
> -               taglen = optptr[1];
> +               case IPOPT_END:
> +                       return NULL;
> +               case IPOPT_NOOP:
> +                       taglen = 1;
> +                       break;
> +               default:
> +                       taglen = optptr[1];
> +               }
>                 optlen -= taglen;
>                 optptr += taglen;
>         }

-- 
paul moore
security @ redhat

^ permalink raw reply	[flat|nested] 5+ messages in thread

[parent not found: <CAGH-KguiiVTyxHp0Z3Z==6b5n2h3Lm4SmU=ruydMpGgctdhYSw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>]

* Re: [PATCH] Cipso: cipso_v4_optptr enter infinite loop
       [not found]   ` <CAGH-KguiiVTyxHp0Z3Z==6b5n2h3Lm4SmU=ruydMpGgctdhYSw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
@ 2017-08-01  8:54     ` yujuan.qi
  0 siblings, 0 replies; 5+ messages in thread
From: yujuan.qi @ 2017-08-01  8:54 UTC (permalink / raw)
  To: Paul Moore
  Cc: Ryder Lee, netdev-u79uwXL29TY76Z2rM5mHXA,
	linux-kernel-u79uwXL29TY76Z2rM5mHXA,
	linux-mediatek-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r, Casey Schaufler,
	David S. Miller

Hi
On Mon, 2017-07-31 at 16:13 -0400, Paul Moore wrote:
> On Sun, Jul 30, 2017 at 11:23 PM, Yujuan Qi <yujuan.qi-NuS5LvNUpcJWk0Htik3J/w@public.gmane.org> wrote:
> > From: "yujuan.qi" <yujuan.qi-NuS5LvNUpcJWk0Htik3J/w@public.gmane.org>
> >
> > in for(),if((optlen > 0) && (optptr[1] == 0)), enter infinite loop.
> >
> > Test: receive a packet which the ip length > 20 and t he first byte of ip option is 0, produce this issue
> >
> > Signed-off-by: yujuan.qi <yujuan.qi-NuS5LvNUpcJWk0Htik3J/w@public.gmane.org>
> > ---
> >  net/ipv4/cipso_ipv4.c | 12 ++++++++++--
> >  1 file changed, 10 insertions(+), 2 deletions(-)
> 
> Considering I gave you the code below I should probably ack it, right? ;)
> 
> Acked-by: Paul Moore <paul-r2n+y4ga6xFZroRs9YW3xA@public.gmane.org>

Yes! Thanks for your suggestions!

> > diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
> > index ae20616..0d1e07d 100644
> > --- a/net/ipv4/cipso_ipv4.c
> > +++ b/net/ipv4/cipso_ipv4.c
> > @@ -1523,9 +1523,17 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
> >         int taglen;
> >
> >         for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
> > -               if (optptr[0] == IPOPT_CIPSO)
> > +               switch (optptr[0]) {
> > +               case IPOPT_CIPSO:
> >                         return optptr;
> > -               taglen = optptr[1];
> > +               case IPOPT_END:
> > +                       return NULL;
> > +               case IPOPT_NOOP:
> > +                       taglen = 1;
> > +                       break;
> > +               default:
> > +                       taglen = optptr[1];
> > +               }
> >                 optlen -= taglen;
> >                 optptr += taglen;
> >         }
> 

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH] Cipso: cipso_v4_optptr enter infinite loop
  2017-07-31  3:23 [PATCH] Cipso: cipso_v4_optptr enter infinite loop Yujuan Qi
  2017-07-31 20:13 ` Paul Moore
@ 2017-08-01 22:31 ` David Miller
  1 sibling, 0 replies; 5+ messages in thread
From: David Miller @ 2017-08-01 22:31 UTC (permalink / raw)
  To: yujuan.qi; +Cc: pmoore, casey, netdev, linux-mediatek, linux-kernel, ryder.lee

From: Yujuan Qi <yujuan.qi@mediatek.com>
Date: Mon, 31 Jul 2017 11:23:01 +0800

> From: "yujuan.qi" <yujuan.qi@mediatek.com>
> 
> in for(),if((optlen > 0) && (optptr[1] == 0)), enter infinite loop.
> 
> Test: receive a packet which the ip length > 20 and the first byte of ip option is 0, produce this issue
> 
> Signed-off-by: yujuan.qi <yujuan.qi@mediatek.com>

Applied, thanks.

^ permalink raw reply	[flat|nested] 5+ messages in thread

[parent not found: <1501241408-19129-1-git-send-email-yujuan.qi@mediatek.com>]

* Re: [PATCH] Cipso: cipso_v4_optptr enter infinite loop
       [not found] <1501241408-19129-1-git-send-email-yujuan.qi@mediatek.com>
@ 2017-07-28 15:12 ` Paul Moore
  0 siblings, 0 replies; 5+ messages in thread
From: Paul Moore @ 2017-07-28 15:12 UTC (permalink / raw)
  To: Yujuan Qi
  Cc: David S. Miller, Casey Schaufler, netdev, linux-mediatek,
	linux-kernel, Ryder Lee

On Fri, Jul 28, 2017 at 7:30 AM, Yujuan Qi <yujuan.qi@mediatek.com> wrote:
> From: "yujuan.qi" <yujuan.qi@mediatek.com>
>
> in for(),if((optlen > 0) && (optptr[1] == 0)), enter infinite loop.
>
> Test: receive a packet which the ip length > 20 and the first byte of ip option is 0, produce this issue
>
> Signed-off-by: yujuan.qi <yujuan.qi@mediatek.com>
> ---
>  net/ipv4/cipso_ipv4.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
> index ae20616..b3d97c7 100644
> --- a/net/ipv4/cipso_ipv4.c
> +++ b/net/ipv4/cipso_ipv4.c
> @@ -1528,6 +1528,8 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
>                 taglen = optptr[1];
>                 optlen -= taglen;
>                 optptr += taglen;
> +               if (!taglen)
> +                       break;
>         }
>
>         return NULL;

Thanks for catching this and submitting a patch.  Unfortunately
checking taglen/optptr[1] isn't going to help with the NOP and EOL
options as they are single byte options.  I think a for-loop like the
following, or something similar, is probably the better solution:

  for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
         switch (optptr[0]) {
         case IPOPT_CIPSO:
                 return optptr;
         case IPOPT_END:
                 return NULL;
         case IPOPT_NOOP:
                 taglen = 1;
                 break;
         default:
                 taglen = optptr[1];
         }
         optlen -= taglen;
         optptr += taglen;
  }

-- 
paul moore
security @ redhat

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2017-08-01 22:31 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-07-31  3:23 [PATCH] Cipso: cipso_v4_optptr enter infinite loop Yujuan Qi
2017-07-31 20:13 ` Paul Moore
     [not found]   ` <CAGH-KguiiVTyxHp0Z3Z==6b5n2h3Lm4SmU=ruydMpGgctdhYSw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2017-08-01  8:54     ` yujuan.qi
2017-08-01 22:31 ` David Miller
     [not found] <1501241408-19129-1-git-send-email-yujuan.qi@mediatek.com>
2017-07-28 15:12 ` Paul Moore

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).