netdev - Re: [PATCH] net: xfrm: Fix potential oops in xfrm_user_rcv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <be2976e7-f2c1-b936-af3b-6454451776b0@cn.fujitsu.com>
Date:   Tue, 5 Mar 2019 15:39:19 +0800
From:   "Su Yanjun <suyj.fnst@...fujitsu.com>" <suyj.fnst@...fujitsu.com>
To:     Steffen Klassert <steffen.klassert@...unet.com>
CC:     Herbert Xu <herbert@...dor.apana.org.au>, <davem@...emloft.net>,
        <netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] net: xfrm: Fix potential oops in xfrm_user_rcv_msg and
 array out of bounds


On 2019/3/5 15:31, Steffen Klassert wrote:
> On Tue, Mar 05, 2019 at 03:08:49PM +0800, Su Yanjun <suyj.fnst@...fujitsu.com> wrote:
>> On 2019/3/5 14:49, Herbert Xu wrote:
>>
>>> On Sun, Mar 03, 2019 at 10:47:39PM -0500, Su Yanjun wrote:
>>>> When i review xfrm_user.c code, i found some potentical bug in it.
>>>>
>>>> In xfrm_user_rcvmsg if type parameter from user space is set to
>>>> XFRM_MSG_MAX or  XFRM_MSG_NEWSADINFO or XFRM_MSG_NEWSPDINFO. It will cause
>>>> xfrm_user_rcv_msg  referring to null entry in xfrm_dispatch array.
>>>>
>>>> Signed-off-by: Su Yanjun <suyj.fnst@...fujitsu.com>
>>>> ---
>>>>    net/xfrm/xfrm_user.c | 4 +++-
>>>>    1 file changed, 3 insertions(+), 1 deletion(-)
>>>>
>>>> diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
>>>> index a131f9f..d832783 100644
>>>> --- a/net/xfrm/xfrm_user.c
>>>> +++ b/net/xfrm/xfrm_user.c
>>>> @@ -2630,11 +2630,13 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
>>>>    		return -EOPNOTSUPP;
>>>>    	type = nlh->nlmsg_type;
>>>> -	if (type > XFRM_MSG_MAX)
>>>> +	if (type >= XFRM_MSG_MAX)
>>>>    		return -EINVAL;
>>> Your patch is wrong.  Please check the definition of XFRM_MSG_MAX.
>> I see, thanks for your reply.
>>
>>   	type -= XFRM_MSG_BASE;
>>   	link = &xfrm_dispatch[type];
>> +	if (!link)
>> +		return -EOPNOTSUPP;
>>
>> Here **link** may refer to null entry for special types such as
>> XFRM_MSG_MAX or  XFRM_MSG_NEWSADINFO or XFRM_MSG_NEWSPDINFO
>> Am i miss something?
> 'link' is always a valid pointer into that array.

Thanks

Su