netdev - Re: [PATCHv3 net] icmp: fix icmp_ext_echo_iio parsing in icmp_build

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <16bd32a3-b716-0a83-3983-85f4a6468645@gmail.com>
Date:   Thu, 14 Oct 2021 07:22:17 -0700
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Xin Long <lucien.xin@...il.com>,
        network dev <netdev@...r.kernel.org>, davem@...emloft.net,
        kuba@...nel.org
Cc:     Eric Dumazet <edumazet@...gle.com>,
        Dan Carpenter <dan.carpenter@...cle.com>,
        Andreas Roeseler <andreas.a.roeseler@...il.com>
Subject: Re: [PATCHv3 net] icmp: fix icmp_ext_echo_iio parsing in
 icmp_build_probe



On 10/14/21 2:50 AM, Xin Long wrote:
> In icmp_build_probe(), the icmp_ext_echo_iio parsing should be done
> step by step and skb_header_pointer() return value should always be
> checked, this patch fixes 3 places in there:
> 
>   - On case ICMP_EXT_ECHO_CTYPE_NAME, it should only copy ident.name
>     from skb by skb_header_pointer(), its len is ident_len. Besides,
>     the return value of skb_header_pointer() should always be checked.
> 
>   - On case ICMP_EXT_ECHO_CTYPE_INDEX, move ident_len check ahead of
>     skb_header_pointer(), and also do the return value check for
>     skb_header_pointer().
> 
>   - On case ICMP_EXT_ECHO_CTYPE_ADDR, before accessing iio->ident.addr.
>     ctype3_hdr.addrlen, skb_header_pointer() should be called first,
>     then check its return value and ident_len.
>     On subcases ICMP_AFI_IP and ICMP_AFI_IP6, also do check for ident.
>     addr.ctype3_hdr.addrlen and skb_header_pointer()'s return value.
>     On subcase ICMP_AFI_IP, the len for skb_header_pointer() should be
>     "sizeof(iio->extobj_hdr) + sizeof(iio->ident.addr.ctype3_hdr) +
>     sizeof(struct in_addr)" or "ident_len".
> 
> v1->v2:
>   - To make it more clear, call skb_header_pointer() once only for
>     iio->indent's parsing as Jakub Suggested.
> v2->v3:
>   - The extobj_hdr.length check against sizeof(_iio) should be done
>     before calling skb_header_pointer(), as Eric noticed.
> 
> Fixes: d329ea5bd884 ("icmp: add response to RFC 8335 PROBE messages")
> Reported-by: Dan Carpenter <dan.carpenter@...cle.com>
> Signed-off-by: Xin Long <lucien.xin@...il.com>
> ---

Reviewed-by: Eric Dumazet <edumazet@...gle.com>

Thanks !