netdev - Re: [PATCH] cipso: simplify cipso_v4_translate() when !CONFIG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4007061.3MtKnenLV1@sifl>
Date:	Wed, 20 Nov 2013 14:45:19 -0500
From:	Paul Moore <pmoore@...hat.com>
To:	David Miller <davem@...emloft.net>
Cc:	netdev@...r.kernel.org
Subject: Re: [PATCH] cipso: simplify cipso_v4_translate() when !CONFIG_NETLABEL

On Wednesday, November 20, 2013 02:34:07 PM David Miller wrote:
> From: Paul Moore <pmoore@...hat.com>
> Date: Wed, 20 Nov 2013 14:25:48 -0500
> 
> > Previous commits corrected some problems with cipso_v4_translate()
> > when CONFIG_NETLABEL=n but some additional work is needed to tidy
> > things up a bit.
> > 
> > Signed-off-by: Paul Moore <pmoore@...hat.com>
> 
> That's really vague, please describe exactly what is wrong with the
> existing conditional and how you have fixed it.

I kinda figured the one line patch and "some additional work is needed to tidy 
things up a bit" summed it up nicely, but I guess not so here ya go ...

First, for reference, here is the diff one more time (some whitespace damage 
in the paste below for readability):

> diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h
> index a8c2ef6..2244e02 100644
> --- a/include/net/cipso_ipv4.h
> +++ b/include/net/cipso_ipv4.h
> @@ -304,7 +304,7 @@ static inline int cipso_v4_validate(...)
>   for (opt_iter = 6; opt_iter < opt_len;) {   
>       tag_len = opt[opt_iter + 1];
> 
> -     if ((tag_len == 0) || (opt[opt_iter + 1] > (opt_len - opt_iter))) {
> +     if ((tag_len == 0) || (tag_len > (opt_len - opt_iter))) { 
>            err_offset = opt_iter + 1;
>            goto out;        
>       }

Looking at the original conditional:

 if ((tag_len == 0) || (opt[opt_iter + 1] > (opt_len - opt_iter))

... and the replacement:

 if ((tag_len == 0) || (tag_len > (opt_len - opt_iter)))

... we notice that "(opt[opt_iter + 1] > (opt_len - opt_iter))" has been 
replaced with "(tag_len > (opt_len - opt_iter))", substituting 'tag_len' for 
'opt[opt_iter + 1]'.  This is acceptable because the the first statement in 
the for loop is:

 tag_len = opt[opt_iter + 1]

... which matches the substitution in the conditional.  I'm not sure how much 
more explicit I can be about this change, it is really pretty minor.

-- 
paul moore
security and virtualization @ redhat

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html