netdev - Re: [Patch v2 1/5] pktgen: fix crash when generating IPv6 packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20121010.223354.756507387487997570.davem@davemloft.net>
Date:	Wed, 10 Oct 2012 22:33:54 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	amwang@...hat.com
Cc:	netdev@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [Patch v2 1/5] pktgen: fix crash when generating IPv6 packets

From: Cong Wang <amwang@...hat.com>
Date: Wed, 10 Oct 2012 11:48:16 +0800

> For IPv6, sizeof(struct ipv6hdr) = 40, thus the following
> expression will result negative:
> 
>         datalen = pkt_dev->cur_pkt_size - 14 -
>                   sizeof(struct ipv6hdr) - sizeof(struct udphdr) -
>                   pkt_dev->pkt_overhead;
> 
> And,  the check "if (datalen < sizeof(struct pktgen_hdr))" will be
> passed as "datalen" is promoted to unsigned, therefore will cause
> a crash later.
> 
> This is a quick fix by checking if "datalen" is negative. The following
> patch will increase the default value of 'min_pkt_size' for IPv6.
> 
> This bug should exist for a long time, so Cc -stable too.
> 
> Cc: <stable@...r.kernel.org>
> Cc: David S. Miller <davem@...emloft.net>
> Signed-off-by: Cong Wang <amwang@...hat.com>

Applied.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html