Re: [PATCHv3 net 3/3] net: sched: ife: check on metadata length

[Eric Dumazet <eric.dumazet@gmail.com>]

On 04/19/2018 03:14 PM, Alexander Aring wrote:
> This patch checks if sk buffer is available to dererence ife header. If
> not then NULL will returned to signal an malformed ife packet. This
> avoids to crashing the kernel from outside.
> 
> Signed-off-by: Alexander Aring <aring@mojatatu.com>
> Reviewed-by: Yotam Gigi <yotam.gi@gmail.com>
> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
> ---
>  net/ife/ife.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/net/ife/ife.c b/net/ife/ife.c
> index 7fbe70a0af4b..570a18d4ca32 100644
> --- a/net/ife/ife.c
> +++ b/net/ife/ife.c
> @@ -70,6 +70,9 @@ void *ife_decode(struct sk_buff *skb, u16 *metalen)
>  	u16 ifehdrln;
>  
>  	ifehdr = (struct ifeheadr *) (skb->data + skb->dev->hard_header_len);
> +	if (!pskb_may_pull(skb, skb->dev->hard_header_len + IFE_METAHDRLEN))
> +		return NULL;
> +



No, you need to move here :

       ifehdr = (struct ifeheadr *) (skb->data + skb->dev->hard_header_len);

>  	ifehdrln = ntohs(ifehdr->metalen);
>  	total_pull = skb->dev->hard_header_len + ifehdrln;
>  
> 


Please do not rush, wait one day before sending V4, no need to flood netdev@