netdev - Re: [Patch net] gre: verify packet before using inner header

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 8 May 2013 00:31:41 -0700
From:	Pravin Shelar <pshelar@...ira.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
Cc:	Cong Wang <amwang@...hat.com>, netdev@...r.kernel.org,
	"David S. Miller" <davem@...emloft.net>
Subject: Re: [Patch net] gre: verify packet before using inner header

I found easier way to fix this issue. I posted patch - "gso: Handle
Trans-Ether-Bridging protocol in skb_network_protocol()"

On Tue, May 7, 2013 at 6:18 AM, Eric Dumazet <eric.dumazet@...il.com> wrote:
> On Tue, 2013-05-07 at 16:20 +0800, Cong Wang wrote:
>> From: Cong Wang <amwang@...hat.com>
>>
>> We use ->h_proto of the inner mac header before calling
>> pskb_may_pull() to verify the length of the packet.
>> This might not be a problem, but at least we'd better
>> error out as early as possible.
>>
>> Cc: Eric Dumazet <eric.dumazet@...il.com>
>> Cc: Pravin B Shelar <pshelar@...ira.com>
>> Cc: David S. Miller <davem@...emloft.net>
>> Signed-off-by: Cong Wang <amwang@...hat.com>
>>
>> ---
>> diff --git a/net/ipv4/gre.c b/net/ipv4/gre.c
>> index cc22363..8a90c67 100644
>> --- a/net/ipv4/gre.c
>> +++ b/net/ipv4/gre.c
>> @@ -149,6 +149,9 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
>>       } else
>>               csum = false;
>>
>> +     if (unlikely(!pskb_may_pull(skb, ghl)))
>> +             goto out;
>> +
>
> No, you're adding yet another bug [1]
>
> If you are not sure you fix one, just forget this patch.
>
> [1] Check commits :
> d14a489a411937fb9420fe2b05168ee9e1e06c9c
> 22251c73ca63b5b1050724be9b54910c101a5f30
> 96af69ea2a83d292238bdba20e4508ee967cf8cb
> 1b05c4b50edbddbdde715c4a7350629819f6655e
> ab43ed8b7490cb387782423ecf74aeee7237e591
> 9cb429d692b341e972b12e6cd097364050ebbb26
>
>
>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html