netdev - [PATCH] keys, dns: Fix size check of V1 server-list header

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1850031.1704921100@warthog.procyon.org.uk>
Date: Wed, 10 Jan 2024 21:11:40 +0000
From: David Howells <dhowells@...hat.com>
To: Linus Torvalds <torvalds@...ux-foundation.org>,
    Edward Adam Davis <eadavis@...com>,
    Pengfei Xu <pengfei.xu@...el.com>
Cc: dhowells@...hat.com, Simon Horman <horms@...nel.org>,
    Markus Suvanto <markus.suvanto@...il.com>,
    Jeffrey E Altman <jaltman@...istor.com>,
    Marc Dionne <marc.dionne@...istor.com>,
    Wang Lei <wang840925@...il.com>, Jeff Layton <jlayton@...hat.com>,
    Steve French <smfrench@...il.com>,
    Jarkko Sakkinen <jarkko@...nel.org>,
    "David S. Miller" <davem@...emloft.net>,
    Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>,
    Paolo Abeni <pabeni@...hat.com>, linux-afs@...ts.infradead.org,
    keyrings@...r.kernel.org, linux-cifs@...r.kernel.org,
    linux-nfs@...r.kernel.org, ceph-devel@...r.kernel.org,
    netdev@...r.kernel.org, linux-fsdevel@...r.kernel.org,
    linux-kernel@...r.kernel.org
Subject: [PATCH] keys, dns: Fix size check of V1 server-list header

    
Fix the size check added to dns_resolver_preparse() for the V1 server-list
header so that it doesn't give EINVAL if the size supplied is the same as
the size of the header struct (which should be valid).

This can be tested with:

        echo -n -e '\0\0\01\xff\0\0' | keyctl padd dns_resolver desc @p

which will give "add_key: Invalid argument" without this fix.

Fixes: 1997b3cb4217 ("keys, dns: Fix missing size check of V1 server-list header")
Reported-by: Pengfei Xu <pengfei.xu@...el.com>
Link: https://lore.kernel.org/r/ZZ4fyY4r3rqgZL+4@xpf.sh.intel.com/
Signed-off-by: David Howells <dhowells@...hat.com>
cc: Edward Adam Davis <eadavis@...com>
cc: Linus Torvalds <torvalds@...ux-foundation.org>
cc: Simon Horman <horms@...nel.org>
Cc: Jarkko Sakkinen <jarkko@...nel.org>
Cc: Jeffrey E Altman <jaltman@...istor.com>
Cc: Wang Lei <wang840925@...il.com>
Cc: Jeff Layton <jlayton@...hat.com>
Cc: Steve French <sfrench@...ibm.com>
Cc: Marc Dionne <marc.dionne@...istor.com>
Cc: "David S. Miller" <davem@...emloft.net>
Cc: Eric Dumazet <edumazet@...gle.com>
Cc: Jakub Kicinski <kuba@...nel.org>
Cc: Paolo Abeni <pabeni@...hat.com>
---
 net/dns_resolver/dns_key.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index f18ca02aa95a..c42ddd85ff1f 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -104,7 +104,7 @@ dns_resolver_preparse(struct key_preparsed_payload *prep)
 		const struct dns_server_list_v1_header *v1;
 
 		/* It may be a server list. */
-		if (datalen <= sizeof(*v1))
+		if (datalen < sizeof(*v1))
 			return -EINVAL;
 
 		v1 = (const struct dns_server_list_v1_header *)data;