netdev - Re: [PATCH] ip: ip_options_compile() resilient to NULL skb route

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20110414123058.d4ffe7fb.shimoda.hiroaki@gmail.com>
Date:	Thu, 14 Apr 2011 12:30:58 +0900
From:	Hiroaki SHIMODA <shimoda.hiroaki@...il.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
Cc:	Stephen Hemminger <shemminger@...tta.com>,
	David Miller <davem@...emloft.net>, lkml@...tdoyle.com,
	netdev@...r.kernel.org
Subject: Re: [PATCH] ip: ip_options_compile() resilient to NULL skb route

On Thu, 14 Apr 2011 05:03:34 +0200
Eric Dumazet <eric.dumazet@...il.com> wrote:

> Le mercredi 13 avril 2011 à 19:54 -0700, Stephen Hemminger a écrit :
> 
> > I like this because it lets the bridge be transparent.
> > The existing options code adds entry in record route, and which
> > is not desirable.
> 
> OK then, I realize I should have submitted a full patch, here it is.
> 
> Thanks !
> 
> [PATCH] ip: ip_options_compile() resilient to NULL skb route
> 
> Scot Doyle demonstrated ip_options_compile() could be called with an skb
> without an attached route, using a setup involving a bridge, netfilter,
> and forged IP packets.
> 
> Let's make ip_options_compile() a bit more robust, instead of changing
> bridge/netfilter code.

And ip_options_rcv_srr() in br_parse_ip_options() also 
expects an skb with attached route, so below patch is needed ?

diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index 28a736f..3af1968 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -603,7 +603,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)
 	unsigned long orefdst;
 	int err;
 
-	if (!opt->srr)
+	if (!opt->srr || !rt)
 		return 0;
 
 	if (skb->pkt_type != PACKET_HOST)

Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html