lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 26 Dec 2020 15:44:53 -0800 From: Cong Wang <xiyou.wangcong@...il.com> To: netdev@...r.kernel.org Cc: Cong Wang <cong.wang@...edance.com>, syzbot+f583ce3d4ddf9836b27a@...kaller.appspotmail.com, William Tu <u9012063@...il.com>, Lorenzo Bianconi <lorenzo.bianconi@...hat.com> Subject: [Patch net] erspan: fix version 1 check in gre_parse_header() From: Cong Wang <cong.wang@...edance.com> Both version 0 and version 1 use ETH_P_ERSPAN, but version 0 does not have an erspan header. So the check in gre_parse_header() is wrong, we have to distinguish version 1 from version 0. We can just check the gre header length like is_erspan_type1(). Fixes: cb73ee40b1b3 ("net: ip_gre: use erspan key field for tunnel lookup") Reported-by: syzbot+f583ce3d4ddf9836b27a@...kaller.appspotmail.com Cc: William Tu <u9012063@...il.com> Cc: Lorenzo Bianconi <lorenzo.bianconi@...hat.com> Signed-off-by: Cong Wang <cong.wang@...edance.com> --- net/ipv4/gre_demux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c index 66fdbfe5447c..5d1e6fe9d838 100644 --- a/net/ipv4/gre_demux.c +++ b/net/ipv4/gre_demux.c @@ -128,7 +128,7 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi, * to 0 and sets the configured key in the * inner erspan header field */ - if (greh->protocol == htons(ETH_P_ERSPAN) || + if ((greh->protocol == htons(ETH_P_ERSPAN) && hdr_len != 4) || greh->protocol == htons(ETH_P_ERSPAN2)) { struct erspan_base_hdr *ershdr; -- 2.25.1
Powered by blists - more mailing lists