netdev - Re: [Patch net] gre: verify packet before using inner header

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 07 May 2013 06:18:35 -0700
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Cong Wang <amwang@...hat.com>
Cc:	netdev@...r.kernel.org, Pravin B Shelar <pshelar@...ira.com>,
	"David S. Miller" <davem@...emloft.net>
Subject: Re: [Patch net] gre: verify packet before using inner header

On Tue, 2013-05-07 at 16:20 +0800, Cong Wang wrote:
> From: Cong Wang <amwang@...hat.com>
> 
> We use ->h_proto of the inner mac header before calling
> pskb_may_pull() to verify the length of the packet.
> This might not be a problem, but at least we'd better
> error out as early as possible.
> 
> Cc: Eric Dumazet <eric.dumazet@...il.com>
> Cc: Pravin B Shelar <pshelar@...ira.com>
> Cc: David S. Miller <davem@...emloft.net>
> Signed-off-by: Cong Wang <amwang@...hat.com>
> 
> ---
> diff --git a/net/ipv4/gre.c b/net/ipv4/gre.c
> index cc22363..8a90c67 100644
> --- a/net/ipv4/gre.c
> +++ b/net/ipv4/gre.c
> @@ -149,6 +149,9 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
>  	} else
>  		csum = false;
>  
> +	if (unlikely(!pskb_may_pull(skb, ghl)))
> +		goto out;
> +

No, you're adding yet another bug [1]

If you are not sure you fix one, just forget this patch.

[1] Check commits :
d14a489a411937fb9420fe2b05168ee9e1e06c9c
22251c73ca63b5b1050724be9b54910c101a5f30
96af69ea2a83d292238bdba20e4508ee967cf8cb
1b05c4b50edbddbdde715c4a7350629819f6655e
ab43ed8b7490cb387782423ecf74aeee7237e591
9cb429d692b341e972b12e6cd097364050ebbb26



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html