netdev - Re: [PATCH net] sctp: fix ICMP processing if skb is non-linear

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1495469356.5672.6.camel@redhat.com>
Date:   Mon, 22 May 2017 18:09:16 +0200
From:   Davide Caratti <dcaratti@...hat.com>
To:     Xin Long <lucien.xin@...il.com>,
        Marcelo Ricardo Leitner <marcelo.leitner@...il.com>
Cc:     network dev <netdev@...r.kernel.org>, linux-sctp@...r.kernel.org,
        "David S. Miller" <davem@...emloft.net>
Subject: Re: [PATCH net] sctp: fix ICMP processing if skb is non-linear

hello Xin Long,
On Sat, 2017-05-20 at 02:40 +0800, Xin Long wrote:
> On Fri, May 19, 2017 at 11:34 PM, Davide Caratti <dcaratti@...hat.com> wrote:
> > @@ -515,14 +515,23 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
> >          * or the chunk type or the Initiate Tag does not match, silently
> >          * discard the packet.
> >          */
> > +       offset = skb_transport_offset(skb);
> > +       sctphdr = skb_header_pointer(skb, offset, sizeof(_sctphdr), &_sctphdr);
> > +       if (unlikely(!sctphdr))
> > +               goto out;
> > +
> > +       vtag = ntohl(sctphdr->vtag);
> >         if (vtag == 0) {
> > -               chunkhdr = (void *)sctphdr + sizeof(struct sctphdr);
> > -               if (len < sizeof(struct sctphdr) + sizeof(sctp_chunkhdr_t)
> > -                         + sizeof(__be32) ||
> > +               offset += sizeof(_sctphdr);
> 
> will be nice to delete this line, and use
> > +               /* chunk header + first 4 octects of init header */
> > +               chunkhdr = skb_header_pointer(skb, offset,
> 
> chunkhdr = skb_header_pointer(skb, offset + sizeof(_sctphdr), ;)
> wdyt?

that's right, 'offset' does not need the re-assignment: I will post the v2
soon. Thanks!

--
davide