linux-kernel - Re: [PATCH] net: sock: validate data_len before allocating skb in sock_alloc_send

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20120530.030205.1337682162603770949.davem@davemloft.net>
Date:	Wed, 30 May 2012 03:02:05 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	eric.dumazet@...il.com
Cc:	jasowang@...hat.com, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	mst@...hat.com
Subject: Re: [PATCH] net: sock: validate data_len before allocating skb in
 sock_alloc_send_pskb()

From: Eric Dumazet <eric.dumazet@...il.com>
Date: Wed, 30 May 2012 08:46:23 +0200

> Why doing this test in the while (1) block, it should be done before the
> loop...
> 
> Or even in the caller, note net/unix/af_unix.c does this right.
> 
>         if (len > SKB_MAX_ALLOC)
>                 data_len = min_t(size_t,
>                                  len - SKB_MAX_ALLOC,
>                                  MAX_SKB_FRAGS * PAGE_SIZE);
> 
>         skb = sock_alloc_send_pskb(sk, len - data_len, data_len,
>                                    msg->msg_flags & MSG_DONTWAIT, &err);

My impression is that the callers should be fixed to.  It makes no sense
to penalize the call sites that get this right.

And yes, if we do check it in sock_alloc_send_pskb() it should be done
at function entry, not inside the loop.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/