netdev - Re: [PATCH net] nsh: fix infinite loop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180504092359.7a78a74a@redhat.com>
Date:   Fri, 4 May 2018 09:23:59 +0200
From:   Jiri Benc <jbenc@...hat.com>
To:     Eric Dumazet <edumazet@...gle.com>
Cc:     "David S . Miller" <davem@...emloft.net>,
        netdev <netdev@...r.kernel.org>,
        Eric Dumazet <eric.dumazet@...il.com>
Subject: Re: [PATCH net] nsh: fix infinite loop

On Thu,  3 May 2018 13:37:54 -0700, Eric Dumazet wrote:
> diff --git a/net/nsh/nsh.c b/net/nsh/nsh.c
> index d7da99a0b0b852d7459eed9ac6d3cdf3d49a1a1c..9696ef96b719bf24625adea2a959deac1d2a975f 100644
> --- a/net/nsh/nsh.c
> +++ b/net/nsh/nsh.c
> @@ -57,6 +57,8 @@ int nsh_pop(struct sk_buff *skb)
>  		return -ENOMEM;
>  	nh = (struct nshhdr *)(skb->data);
>  	length = nsh_hdr_len(nh);
> +	if (length < NSH_BASE_HDR_LEN)
> +		return -EINVAL;
>  	inner_proto = tun_p_to_eth_p(nh->np);
>  	if (!pskb_may_pull(skb, length))
>  		return -ENOMEM;
> @@ -90,6 +92,8 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb,
>  	if (unlikely(!pskb_may_pull(skb, NSH_BASE_HDR_LEN)))
>  		goto out;
>  	nsh_len = nsh_hdr_len(nsh_hdr(skb));
> +	if (nsh_len < NSH_BASE_HDR_LEN)
> +		goto out;
>  	if (unlikely(!pskb_may_pull(skb, nsh_len)))
>  		goto out;
>  

Acked-by: Jiri Benc <jbenc@...hat.com>

Thanks, Eric, and shame on me!

 Jiri