netdev - Re: [RFC PATCH] tcp: use of undefined variable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 20 Sep 2012 17:31:50 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	alan@...rguk.ukuu.org.uk
Cc:	netdev@...r.kernel.org
Subject: Re: [RFC PATCH] tcp: use of undefined variable

From: Alan Cox <alan@...rguk.ukuu.org.uk>
Date: Wed, 19 Sep 2012 15:46:06 +0100

> From: Alan Cox <alan@...ux.intel.com>
> 
> Both tcp_timewait_state_process and tcp_check_req use the same basic
> construct of
> 
> 	struct tcp_options received tmp_opt;
> 	tmp_opt.saw_tstamp = 0;
> 
> then call
> 
> 	tcp_parse_options
> 
> However if they are fed a frame containing a TCP_SACK then tbe code
> behaviour is undefined because opt_rx->sack_ok is undefined data.
> 
> This ought to be documented if it is intentional.
> 
> Signed-off-by: Alan Cox <alan@...ux.intel.com>

Applied to net-next, except I took this hunk out:

> @@ -96,6 +98,7 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
>  	bool paws_reject = false;
>  
>  	tmp_opt.saw_tstamp = 0;
> +
>  	if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
>  		tcp_parse_options(skb, &tmp_opt, &hash_location, 0, NULL);
>  

Since it's unrelated to your change, and if you were going to do this in
tcp_timewait_state_process() you should do it in tcp_check_req() as well
since the code is identical.

Longer term maybe we probably should add a
tcp_minisock_parse_options() that elides TCP_SACK and other bits these
cases do not want.

Thanks Alan.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html