netdev - Re: [PATCH net] igmp: limit igmpv3_newpack() packet size to IP_MAX

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230905110653.GD2146@kernel.org>
Date: Tue, 5 Sep 2023 13:06:53 +0200
From: Simon Horman <horms@...nel.org>
To: Eric Dumazet <edumazet@...gle.com>
Cc: "David S . Miller" <davem@...emloft.net>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	netdev@...r.kernel.org, eric.dumazet@...il.com,
	David Laight <David.Laight@...lab.com>,
	Kyle Zeng <zengyhkyle@...il.com>
Subject: Re: [PATCH net] igmp: limit igmpv3_newpack() packet size to
 IP_MAX_MTU

On Tue, Sep 05, 2023 at 04:23:38AM +0000, Eric Dumazet wrote:
> This is a follow up of commit 915d975b2ffa ("net: deal with integer
> overflows in kmalloc_reserve()") based on David Laight feedback.
> 
> Back in 2010, I failed to realize malicious users could set dev->mtu
> to arbitrary values. This mtu has been since limited to 0x7fffffff but
> regardless of how big dev->mtu is, it makes no sense for igmpv3_newpack()
> to allocate more than IP_MAX_MTU and risk various skb fields overflows.
> 
> Fixes: 57e1ab6eaddc ("igmp: refine skb allocations")
> Link: https://lore.kernel.org/netdev/d273628df80f45428e739274ab9ecb72@AcuMS.aculab.com/
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Reported-by: David Laight <David.Laight@...LAB.COM>
> Cc: Kyle Zeng <zengyhkyle@...il.com>

Reviewed-by: Simon Horman <horms@...nel.org>