Commit 04a6b8bf authored Sep 11, 2015 by Mathias Krause Committed by Steffen Klassert Sep 14, 2015

xfrm6: Fix ICMPv6 and MH header checks in _decode_session6



Ensure there's enough data left prior calling pskb_may_pull(). If
skb->data was already advanced, we'll call pskb_may_pull() with a
negative value converted to unsigned int -- leading to a huge
positive value. That won't matter in practice as pskb_may_pull()
will likely fail in this case, but it leads to underflow reports on
kernels handling such kind of over-/underflows, e.g. a PaX enabled
kernel instrumented with the size_overflow plugin.

Reported-by: satmd <satmd@lain.at>
Reported-and-tested-by: Marcin Jurkowski <marcin1j@gmail.com>
Signed-off-by: Mathias Krause <mathias.krause@secunet.com>
Cc: PaX Team <pageexec@freemail.hu>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

parent 93efac3f

net/ipv6/xfrm6_policy.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -178,7 +178,8 @@ _decode_session6(struct sk_buff skb, struct flowi fl, int reverse)
		return;

		case IPPROTO_ICMPV6:
		if (!onlyproto && pskb_may_pull(skb, nh + offset + 2 - skb->data)) {
		if (!onlyproto && (nh + offset + 2 < skb->data \|\|
		pskb_may_pull(skb, nh + offset + 2 - skb->data))) {
		u8 *icmp;

		nh = skb_network_header(skb);
		@@ -192,7 +193,8 @@ _decode_session6(struct sk_buff skb, struct flowi fl, int reverse)
		#if IS_ENABLED(CONFIG_IPV6_MIP6)
		case IPPROTO_MH:
		offset += ipv6_optlen(exthdr);
		if (!onlyproto && pskb_may_pull(skb, nh + offset + 3 - skb->data)) {
		if (!onlyproto && (nh + offset + 3 < skb->data \|\|
		pskb_may_pull(skb, nh + offset + 3 - skb->data))) {
		struct ip6_mh *mh;

		nh = skb_network_header(skb);

Admin message