xfrm6: Fix ICMPv6 and MH header checks in _decode_session6
Ensure there's enough data left prior calling pskb_may_pull(). If skb->data was already advanced, we'll call pskb_may_pull() with a negative value converted to unsigned int -- leading to a huge positive value. That won't matter in practice as pskb_may_pull() will likely fail in this case, but it leads to underflow reports on kernels handling such kind of over-/underflows, e.g. a PaX enabled kernel instrumented with the size_overflow plugin. Reported-by: satmd <satmd@lain.at> Reported-and-tested-by: Marcin Jurkowski <marcin1j@gmail.com> Signed-off-by: Mathias Krause <mathias.krause@secunet.com> Cc: PaX Team <pageexec@freemail.hu> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
This commit is contained in:
Родитель
93efac3f2e
Коммит
04a6b8bfee
|
@ -178,7 +178,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
|
|||
return;
|
||||
|
||||
case IPPROTO_ICMPV6:
|
||||
if (!onlyproto && pskb_may_pull(skb, nh + offset + 2 - skb->data)) {
|
||||
if (!onlyproto && (nh + offset + 2 < skb->data ||
|
||||
pskb_may_pull(skb, nh + offset + 2 - skb->data))) {
|
||||
u8 *icmp;
|
||||
|
||||
nh = skb_network_header(skb);
|
||||
|
@ -192,7 +193,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
|
|||
#if IS_ENABLED(CONFIG_IPV6_MIP6)
|
||||
case IPPROTO_MH:
|
||||
offset += ipv6_optlen(exthdr);
|
||||
if (!onlyproto && pskb_may_pull(skb, nh + offset + 3 - skb->data)) {
|
||||
if (!onlyproto && (nh + offset + 3 < skb->data ||
|
||||
pskb_may_pull(skb, nh + offset + 3 - skb->data))) {
|
||||
struct ip6_mh *mh;
|
||||
|
||||
nh = skb_network_header(skb);
|
||||
|
|
Загрузка…
Ссылка в новой задаче