69 lines
2.3 KiB
Diff
69 lines
2.3 KiB
Diff
From: Benjamin Poirier <bpoirier@suse.com>
|
|
Date: Mon, 28 Aug 2017 14:29:41 -0400
|
|
Subject: packet: Don't write vnet header beyond end of buffer
|
|
Origin: https://git.kernel.org/linus/edbd58be15a957f6a760c4a514cd475217eb97fd
|
|
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-14497
|
|
|
|
... which may happen with certain values of tp_reserve and maclen.
|
|
|
|
Fixes: 58d19b19cd99 ("packet: vnet_hdr support for tpacket_rcv")
|
|
Signed-off-by: Benjamin Poirier <bpoirier@suse.com>
|
|
Cc: Willem de Bruijn <willemb@google.com>
|
|
Acked-by: Willem de Bruijn <willemb@google.com>
|
|
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
---
|
|
net/packet/af_packet.c | 12 +++++++++---
|
|
1 file changed, 9 insertions(+), 3 deletions(-)
|
|
|
|
--- a/net/packet/af_packet.c
|
|
+++ b/net/packet/af_packet.c
|
|
@@ -2192,6 +2192,7 @@ static int tpacket_rcv(struct sk_buff *s
|
|
struct timespec ts;
|
|
__u32 ts_status;
|
|
bool is_drop_n_account = false;
|
|
+ bool do_vnet = false;
|
|
|
|
/* struct tpacket{2,3}_hdr is aligned to a multiple of TPACKET_ALIGNMENT.
|
|
* We may add members to them until current aligned size without forcing
|
|
@@ -2242,8 +2243,10 @@ static int tpacket_rcv(struct sk_buff *s
|
|
netoff = TPACKET_ALIGN(po->tp_hdrlen +
|
|
(maclen < 16 ? 16 : maclen)) +
|
|
po->tp_reserve;
|
|
- if (po->has_vnet_hdr)
|
|
+ if (po->has_vnet_hdr) {
|
|
netoff += sizeof(struct virtio_net_hdr);
|
|
+ do_vnet = true;
|
|
+ }
|
|
macoff = netoff - maclen;
|
|
}
|
|
if (po->tp_version <= TPACKET_V2) {
|
|
@@ -2260,8 +2263,10 @@ static int tpacket_rcv(struct sk_buff *s
|
|
skb_set_owner_r(copy_skb, sk);
|
|
}
|
|
snaplen = po->rx_ring.frame_size - macoff;
|
|
- if ((int)snaplen < 0)
|
|
+ if ((int)snaplen < 0) {
|
|
snaplen = 0;
|
|
+ do_vnet = false;
|
|
+ }
|
|
}
|
|
} else if (unlikely(macoff + snaplen >
|
|
GET_PBDQC_FROM_RB(&po->rx_ring)->max_frame_len)) {
|
|
@@ -2274,6 +2279,7 @@ static int tpacket_rcv(struct sk_buff *s
|
|
if (unlikely((int)snaplen < 0)) {
|
|
snaplen = 0;
|
|
macoff = GET_PBDQC_FROM_RB(&po->rx_ring)->max_frame_len;
|
|
+ do_vnet = false;
|
|
}
|
|
}
|
|
spin_lock(&sk->sk_receive_queue.lock);
|
|
@@ -2299,7 +2305,7 @@ static int tpacket_rcv(struct sk_buff *s
|
|
}
|
|
spin_unlock(&sk->sk_receive_queue.lock);
|
|
|
|
- if (po->has_vnet_hdr) {
|
|
+ if (do_vnet) {
|
|
if (virtio_net_hdr_from_skb(skb, h.raw + macoff -
|
|
sizeof(struct virtio_net_hdr),
|
|
vio_le(), true)) {
|