lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 12 Jul 2012 23:58:37 +0900 From: Hiroaki SHIMODA <shimoda.hiroaki@...il.com> To: David Miller <davem@...emloft.net> Cc: netdev@...r.kernel.org Subject: Re: [PATCH 02/16] ipv4: Deliver ICMP redirects to sockets too. On Thu, 12 Jul 2012 01:10:49 -0700 (PDT) David Miller <davem@...emloft.net> wrote: > > And thus, we can remove the ping_err() hack. > > Signed-off-by: David S. Miller <davem@...emloft.net> > --- > net/ipv4/icmp.c | 8 +------- > 1 file changed, 1 insertion(+), 7 deletions(-) > > diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c > index 18e39d1..5885146 100644 > --- a/net/ipv4/icmp.c > +++ b/net/ipv4/icmp.c > @@ -782,13 +782,7 @@ static void icmp_redirect(struct sk_buff *skb) > break; > } > > - /* Ping wants to see redirects. > - * Let's pretend they are errors of sorts... */ > - if (iph->protocol == IPPROTO_ICMP && > - iph->ihl >= 5 && > - pskb_may_pull(skb, (iph->ihl<<2)+8)) { > - ping_err(skb, icmp_hdr(skb)->un.gateway); > - } > + icmp_socket_deliver(skb, icmp_hdr(skb)->un.gateway); icmp_redirect() just checks skb->len is larger than sizeof(struct iphdr) and then ping_err() is called. In ping_err(), *icmph is derived from following code without sanity check of skb->len. So, I think avobe deleted checks about skb->len need to move to ping_err() in case of packets are malformed. struct icmphdr *icmph = (struct icmphdr *)(skb->data+(iph->ihl<<2)) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists