netdev - [PATCH net 0/2] Fix vlan tag handling for vlan packets without ethernet headers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 29 Mar 2018 19:05:28 +0900
From:   Toshiaki Makita <makita.toshiaki@....ntt.co.jp>
To:     "David S. Miller" <davem@...emloft.net>
Cc:     Toshiaki Makita <makita.toshiaki@....ntt.co.jp>,
        netdev@...r.kernel.org, Eric Dumazet <eric.dumazet@...il.com>
Subject: [PATCH net 0/2] Fix vlan tag handling for vlan packets without ethernet headers

Eric Dumazet reported syzbot found a new bug which leads to underflow of
size argument of memmove(), causing crash[1]. This can be triggered by tun
devices.

The underflow happened because skb_vlan_untag() did not expect vlan packets
without ethernet headers, and tun can produce such packets.
I also checked vlan_insert_inner_tag() and found a similar bug.

This series fixes these problems.

[1] https://marc.info/?l=linux-netdev&m=152221753920510&w=2

Toshiaki Makita (2):
  net: Fix untag for vlan packets without ethernet header
  vlan: Fix vlan insertion for packets without ethernet header

 include/linux/if_vlan.h | 15 +++++++++++++--
 net/core/skbuff.c       |  6 ++++--
 2 files changed, 17 insertions(+), 4 deletions(-)

-- 
1.8.3.1