lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <5444E5A0.9040004@cogentembedded.com> Date: Mon, 20 Oct 2014 14:36:16 +0400 From: Sergei Shtylyov <sergei.shtylyov@...entembedded.com> To: roy.qing.li@...il.com, netdev@...r.kernel.org CC: steffen.klassert@...unet.com Subject: Re: [PATCH 2/2] xfrm6: fix a potential use after free in xfrm6_policy.c Hello. On 10/20/2014 12:49 PM, roy.qing.li@...il.com wrote: > From: Li RongQing <roy.qing.li@...il.com> > pskb_may_pull() maybe change skb->data and make nh and exthdr pointer > oboslete, so recompute the nd and exthdr > Signed-off-by: Li RongQing <roy.qing.li@...il.com> > --- > net/ipv6/xfrm6_policy.c | 11 ++++++++--- > 1 file changed, 8 insertions(+), 3 deletions(-) > diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c > index ac49f84..115fd3b 100644 > --- a/net/ipv6/xfrm6_policy.c > +++ b/net/ipv6/xfrm6_policy.c > @@ -170,8 +170,10 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse) > case IPPROTO_DCCP: > if (!onlyproto && (nh + offset + 4 < skb->data || > pskb_may_pull(skb, nh + offset + 4 - skb->data))) { > - __be16 *ports = (__be16 *)exthdr; > + __be16 *ports; > > + nh = skb_network_header(skb); > + ports = (__be16*)(nh + offset); Please insert a space between '__be16' and * like it was done in the deleted assignment. [...] > @@ -180,8 +182,10 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse) > > case IPPROTO_ICMPV6: > if (!onlyproto && pskb_may_pull(skb, nh + offset + 2 - skb->data)) { > - u8 *icmp = (u8 *)exthdr; > + u8 *icmp; > > + nh = skb_network_header(skb); > + icmp = (u8*)(nh + offset); Likewise. [...] > @@ -192,8 +196,9 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse) > case IPPROTO_MH: > if (!onlyproto && pskb_may_pull(skb, nh + offset + 3 - skb->data)) { > struct ip6_mh *mh; > - mh = (struct ip6_mh *)exthdr; > > + nh = skb_network_header(skb); > + mh = (struct ip6_mh*)(nh + offset); Likewise. [...] WBR, Sergei -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists