Patrick McHardy 55820ee2f8
[NET]: Fix signedness issues in net/core/filter.c ...
This is the code to load packet data into a register:
k = fentry->k;
if (k < 0) {
...
} else {
u32 _tmp, *p;
p = skb_header_pointer(skb, k, 4, &_tmp);
if (p != NULL) {
A = ntohl(*p);
continue;
}
}
skb_header_pointer checks if the requested data is within the
linear area:
int hlen = skb_headlen(skb);
if (offset + len <= hlen)
return skb->data + offset;
When offset is within [INT_MAX-len+1..INT_MAX] the addition will
result in a negative number which is <= hlen.
I couldn't trigger a crash on my AMD64 with 2GB of memory, but a
coworker tried on his x86 machine and it crashed immediately.
This patch fixes the check in skb_header_pointer to handle large
positive offsets similar to skb_copy_bits. Invalid data can still
be accessed using negative offsets (also similar to skb_copy_bits),
anyone using negative offsets needs to verify them himself.
Thanks to Thomas Vögtle <thomas.voegtle@coreworks.de > for verifying the
problem by crashing his machine and providing me with an Oops.
Signed-off-by: Patrick McHardy <kaber@trash.net >
Acked-by: Herbert Xu <herbert@gondor.apana.org.au >
Signed-off-by: David S. Miller <davem@davemloft.net >
2005-07-05 14:08:10 -07:00
2005-06-28 21:20:31 -07:00
2005-06-22 16:07:42 -04:00
2005-06-22 12:38:33 -07:00
2005-06-24 00:06:36 -07:00
2005-06-21 19:07:47 -07:00
2005-06-22 16:07:23 -04:00
2005-06-23 21:00:58 -07:00
2005-06-25 16:25:02 -07:00
2005-06-27 21:52:47 -07:00
2005-06-21 19:07:41 -07:00
2005-06-26 15:28:10 -07:00
2005-06-21 19:07:36 -07:00
2005-06-23 09:45:26 -07:00
2005-06-27 14:33:29 -07:00
2005-06-28 21:20:35 -07:00
2005-06-25 16:24:52 -07:00
2005-06-27 15:11:48 -07:00
2005-06-25 16:24:30 -07:00
2005-06-25 16:24:53 -07:00
2005-06-29 22:48:04 -07:00
2005-06-25 16:24:24 -07:00
2005-06-24 00:05:19 -07:00
2005-06-24 00:05:19 -07:00
2005-06-27 14:33:29 -07:00
2005-06-28 15:58:50 -07:00
2005-06-24 00:06:41 -07:00
2005-06-24 00:05:20 -07:00
2005-06-24 00:05:20 -07:00
2005-06-21 19:07:41 -07:00
2005-06-23 09:45:28 -07:00
2005-06-21 19:07:41 -07:00
2005-06-27 14:33:29 -07:00
2005-06-21 18:46:23 -07:00
2005-06-21 18:46:18 -07:00
2005-06-23 09:45:19 -07:00
2005-06-21 18:46:18 -07:00
2005-06-25 16:24:53 -07:00
2005-06-21 18:46:15 -07:00
2005-06-21 21:52:05 -07:00
2005-06-28 21:20:32 -07:00
2005-06-21 21:52:06 -07:00
2005-06-21 21:51:49 -07:00
2005-06-21 21:51:48 -07:00
2005-06-24 00:05:29 -07:00
2005-06-24 00:05:29 -07:00
2005-06-23 09:45:09 -07:00
2005-06-26 17:54:11 -04:00
2005-06-28 15:46:24 -07:00
2005-06-27 14:33:29 -07:00
2005-06-25 16:24:30 -07:00
2005-06-27 14:47:31 -07:00
2005-06-21 18:46:32 -07:00
2005-06-27 14:33:30 -07:00
2005-06-24 00:05:23 -07:00
2005-06-28 21:20:35 -07:00
2005-06-25 16:24:45 -07:00
2005-06-25 16:24:55 -07:00
2005-06-24 00:05:19 -07:00
2005-06-24 00:05:19 -07:00
2005-06-24 00:05:19 -07:00
2005-06-24 00:05:18 -07:00
2005-06-27 15:23:52 -07:00
2005-06-25 16:24:38 -07:00
2005-06-23 09:45:18 -07:00
2005-06-23 09:45:09 -07:00
2005-06-23 09:45:04 -07:00
2005-06-23 09:45:05 -07:00
2005-06-27 18:03:21 -07:00
2005-06-24 00:06:40 -07:00
2005-06-24 00:06:43 -07:00
2005-06-23 20:12:48 -07:00
2005-06-28 12:54:43 -07:00
2005-06-22 22:05:59 -07:00
2005-06-24 00:06:28 -07:00
2005-06-22 16:07:42 -04:00
2005-06-22 16:07:24 -04:00
2005-06-22 16:07:39 -04:00
2005-06-22 16:07:24 -04:00
2005-06-22 16:07:39 -04:00
2005-06-22 16:07:24 -04:00
2005-06-22 16:07:23 -04:00
2005-06-24 00:06:32 -07:00
2005-06-23 09:45:04 -07:00
2005-06-25 16:25:03 -07:00
2005-06-21 18:46:17 -07:00
2005-06-21 18:46:14 -07:00
2005-07-03 17:37:18 +02:00
2005-06-27 21:52:46 -07:00
2005-06-28 12:56:45 -07:00
2005-06-28 12:56:45 -07:00
2005-06-23 09:45:30 -07:00
2005-06-25 16:24:33 -07:00
2005-06-27 15:11:43 -07:00
2005-06-23 09:45:33 -07:00
2005-06-25 16:24:53 -07:00
2005-06-24 14:14:24 -07:00
2005-06-24 14:14:24 -07:00
2005-06-24 00:05:19 -07:00
2005-06-23 09:45:20 -07:00
2005-06-25 16:24:54 -07:00
2005-06-23 09:45:33 -07:00
2005-06-24 00:05:20 -07:00
2005-06-24 00:05:20 -07:00
2005-06-24 00:06:41 -07:00
2005-06-28 12:56:45 -07:00
2005-06-27 14:33:29 -07:00
2005-06-27 15:11:44 -07:00
2005-06-27 11:12:54 +01:00
2005-07-05 14:08:10 -07:00
2005-06-23 09:45:18 -07:00
2005-06-25 16:24:32 -07:00
2005-06-21 18:46:17 -07:00
2005-06-25 16:24:55 -07:00
2005-06-28 13:24:23 -07:00
2005-06-23 12:21:28 -07:00
2005-06-23 20:37:36 -07:00
2005-06-23 20:59:16 -07:00
2005-06-23 20:49:30 -07:00
2005-06-23 09:45:16 -07:00
2005-06-25 16:24:42 -07:00
2005-06-23 09:45:35 -07:00
2005-06-28 21:20:32 -07:00
2005-06-27 14:43:53 -07:00
2005-06-27 14:43:42 -07:00
2005-06-23 10:04:15 -07:00
2005-06-28 21:20:36 -07:00
2005-06-23 09:45:34 -07:00
2005-06-28 21:20:31 -07:00
2005-06-22 22:16:17 -07:00
55820ee2f8