lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20120610122435.7d5c8fa7@pyramind.ukuu.org.uk> Date: Sun, 10 Jun 2012 12:24:35 +0100 From: Alan Cox <alan@...rguk.ukuu.org.uk> To: Sasha Levin <levinsasha928@...il.com> Cc: dbaryshkov@...il.com, slapin@...fans.org, davem@...emloft.net, linux-zigbee-devel@...ts.sourceforge.net, netdev@...r.kernel.org, linux-kernel@...r.kernel.org Subject: Re: [PATCH] ieee802154: verify packet size before trying to allocate it On Sun, 10 Jun 2012 13:10:19 +0200 Sasha Levin <levinsasha928@...il.com> wrote: > Currently when sending data over datagram, the send function will attempt to > allocate any size passed on from the userspace. > > We should make sure that this size is checked and limited. The maximum size > of an IP packet seemed like the safest limit here. > > Signed-off-by: Sasha Levin <levinsasha928@...il.com> > --- > > Change in v2: > - Limit by maximum size the protocol supports. > > net/ieee802154/dgram.c | 5 +++++ > 1 files changed, 5 insertions(+), 0 deletions(-) > > diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c > index 6fbb2ad..628498c 100644 > --- a/net/ieee802154/dgram.c > +++ b/net/ieee802154/dgram.c > @@ -232,6 +232,11 @@ static int dgram_sendmsg(struct kiocb *iocb, struct sock *sk, > > hlen = LL_RESERVED_SPACE(dev); > tlen = dev->needed_tailroom; > + if (hlen + tlen + size > IEEE802154_MTU) { > + err = -EMSGSIZE; > + goto out; What stops an overflow at this point. We'll then pass a small value to sock_alloc_send_skb/sock_alloc_send_pskb and copy a large number of bytes into it. This does seem to be already broken, and not fixed by the patch ? Alan -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists