netdev - Re: [PATCH net-next ] mpls: In mpls_egress verify the packet length.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87h9tpzv76.fsf@x220.int.ebiederm.org>
Date:	Thu, 12 Mar 2015 17:50:53 -0500
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	David Miller <davem@...emloft.net>
Cc:	rshearma@...cade.com, netdev@...r.kernel.org
Subject: Re: [PATCH net-next ] mpls: In mpls_egress verify the packet length.

David Miller <davem@...emloft.net> writes:

> From: ebiederm@...ssion.com (Eric W. Biederman)
> Date: Thu, 12 Mar 2015 15:54:52 -0500
>
>> Robert Shearman noticed that mpls_egress is failing to verify that
>> the bytes to be examined are in fact present in the packet before
>> mpls_egress reads those bytes.
>> 
>> Reported-by: Robert Shearman <rshearma@...cade.com>
>> Signed-off-by: "Eric W. Biederman" <ebiederm@...ssion.com>
>
> Let's see if we can consolidate these pskb_may_pull() calls into one,
> in the fast path they are relatively cheap but not zero cost.

> The caller (mpls_forward()) is doing one as well.
>
> All you care about is the version field and the hop_limit/ttl.
>
> For ipv4, version is in byte 0, and ttl is in byte 9.
By my count the ttl is in byte 8, and more importantly the
header checksum is in byte 10.

> For ipv6, version is also in byte zero and hop_limit is in byte 7.
>
> Therefore if you do pskb_may_pull(skb, 10) it will cover all cases
> whilst not exceeding the size of either protocol's total header.

Using the value of 12 that seems very reasonable.

> Above the pskb_may_pull() call can add a big comment explaining what
> you are doing and why this is sufficient.

Will do.

Eric
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html