Attachment 299408 Details for Bug 404291 – patch as merged upstream

[patch] patch as merged upstream

esp_frag_fix (text/plain), 1.44 KB, created by Thomas Graf on 2008-03-27 23:22:31 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Graf

Created: 2008-03-27 23:22:31 UTC

Size: 1.44 KB

patch

obsolete

>[ESP]: Ensure IV is in linear part of the skb to avoid BUG() due to OOB access                                         
>
>ESP does not account for the IV size when calling pskb_may_pull() to
>ensure everything it accesses directly is within the linear part of a
>potential fragment. This results in a BUG() being triggered when the
>both the IPv4 and IPv6 ESP stack is fed with an skb where the first
>fragment ends between the end of the esp header and the end of the IV.
>
>This bug was found by Dirk Nehring <dnehring@gmx.net> .
>
>Signed-off-by: Thomas Graf <tgraf@suug.ch>
>
>Index: net-2.6/net/ipv4/esp4.c
>===================================================================
>--- net-2.6.orig/net/ipv4/esp4.c	2008-03-27 23:47:48.000000000 +0100
>+++ net-2.6/net/ipv4/esp4.c	2008-03-27 23:47:58.000000000 +0100
>@@ -336,7 +336,7 @@
> 	struct scatterlist *asg;
> 	int err = -EINVAL;
> 
>-	if (!pskb_may_pull(skb, sizeof(*esph)))
>+	if (!pskb_may_pull(skb, sizeof(*esph) + crypto_aead_ivsize(aead)))
> 		goto out;
> 
> 	if (elen <= 0)
>Index: net-2.6/net/ipv6/esp6.c
>===================================================================
>--- net-2.6.orig/net/ipv6/esp6.c	2008-03-27 23:47:48.000000000 +0100
>+++ net-2.6/net/ipv6/esp6.c	2008-03-27 23:47:58.000000000 +0100
>@@ -282,7 +282,7 @@
> 	struct scatterlist *sg;
> 	struct scatterlist *asg;
> 
>-	if (!pskb_may_pull(skb, sizeof(*esph))) {
>+	if (!pskb_may_pull(skb, sizeof(*esph) + crypto_aead_ivsize(aead))) {
> 		ret = -EINVAL;
> 		goto out;
> 	}

Actions: View | Diff

Attachments on bug 404291: 272881 | 299408