linux-kernel - [PATCH] [192/223] Staging: batman-adv: ensure that eth_type

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 13 Dec 2010 00:48:18 +0100 (CET)
From:	Andi Kleen <andi@...stfloor.org>
To:	lindner_marek@...oo.de, sven.eckelmann@....de, gregkh@...e.de,
	ak@...ux.intel.com, linux-kernel@...r.kernel.org, stable@...nel.org
Subject: [PATCH] [192/223] Staging: batman-adv: ensure that eth_type_trans gets linear memory

2.6.35-longterm review patch.  If anyone has any objections, please let me know.

------------------
From: Marek Lindner <lindner_marek@...oo.de>

commit b6faaae1a15a352d68b3e3cd8b840e56709820bf upstream.

eth_type_trans tries to pull data with the length of the ethernet header
from the skb. We only ensured that enough data for the first ethernet
header and the batman header is available in non-paged memory of the skb
and not for the ethernet after the batman header.

eth_type_trans would fail sometimes with drivers which don't ensure that
all there data is perfectly linearised.

The failure was noticed through a kernel bug Oops generated by the
skb_pull inside eth_type_trans.

Reported-by: Rafal Lesniak <lesniak@...si-project.org>
Signed-off-by: Marek Lindner <lindner_marek@...oo.de>
Signed-off-by: Sven Eckelmann <sven.eckelmann@....de>
Signed-off-by: Greg Kroah-Hartman <gregkh@...e.de>
Signed-off-by: Andi Kleen <ak@...ux.intel.com>

---
 drivers/staging/batman-adv/soft-interface.c |    4 ++++
 1 file changed, 4 insertions(+)

Index: linux/drivers/staging/batman-adv/soft-interface.c
===================================================================
--- linux.orig/drivers/staging/batman-adv/soft-interface.c
+++ linux/drivers/staging/batman-adv/soft-interface.c
@@ -295,6 +295,10 @@ void interface_rx(struct sk_buff *skb, i
 	skb_pull_rcsum(skb, hdr_size);
 /*	skb_set_mac_header(skb, -sizeof(struct ethhdr));*/
 
+	if (unlikely(!pskb_may_pull(skb, ETH_HLEN))) {
+		kfree_skb(skb);
+		return;
+	}
 	skb->dev = dev;
 	skb->protocol = eth_type_trans(skb, dev);
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/