55 lines
1.7 KiB
Diff
55 lines
1.7 KiB
Diff
From 7b48750febb4c3387db39fd0b547936c53ba7364 Mon Sep 17 00:00:00 2001
|
|
From: Seif Mazareeb <seif@marvell.com>
|
|
Date: Thu, 17 Oct 2013 20:33:21 -0700
|
|
Subject: net: fix cipso packet validation when !NETLABEL
|
|
|
|
From: Seif Mazareeb <seif@marvell.com>
|
|
|
|
[ Upstream commit f2e5ddcc0d12f9c4c7b254358ad245c9dddce13b ]
|
|
|
|
When CONFIG_NETLABEL is disabled, the cipso_v4_validate() function could loop
|
|
forever in the main loop if opt[opt_iter +1] == 0, this will causing a kernel
|
|
crash in an SMP system, since the CPU executing this function will
|
|
stall /not respond to IPIs.
|
|
|
|
This problem can be reproduced by running the IP Stack Integrity Checker
|
|
(http://isic.sourceforge.net) using the following command on a Linux machine
|
|
connected to DUT:
|
|
|
|
"icmpsic -s rand -d <DUT IP address> -r 123456"
|
|
wait (1-2 min)
|
|
|
|
Signed-off-by: Seif Mazareeb <seif@marvell.com>
|
|
Acked-by: Paul Moore <paul@paul-moore.com>
|
|
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
---
|
|
include/net/cipso_ipv4.h | 6 ++++--
|
|
1 file changed, 4 insertions(+), 2 deletions(-)
|
|
|
|
--- a/include/net/cipso_ipv4.h
|
|
+++ b/include/net/cipso_ipv4.h
|
|
@@ -290,6 +290,7 @@ static inline int cipso_v4_validate(cons
|
|
unsigned char err_offset = 0;
|
|
u8 opt_len = opt[1];
|
|
u8 opt_iter;
|
|
+ u8 tag_len;
|
|
|
|
if (opt_len < 8) {
|
|
err_offset = 1;
|
|
@@ -302,11 +303,12 @@ static inline int cipso_v4_validate(cons
|
|
}
|
|
|
|
for (opt_iter = 6; opt_iter < opt_len;) {
|
|
- if (opt[opt_iter + 1] > (opt_len - opt_iter)) {
|
|
+ tag_len = opt[opt_iter + 1];
|
|
+ if ((tag_len == 0) || (opt[opt_iter + 1] > (opt_len - opt_iter))) {
|
|
err_offset = opt_iter + 1;
|
|
goto out;
|
|
}
|
|
- opt_iter += opt[opt_iter + 1];
|
|
+ opt_iter += tag_len;
|
|
}
|
|
|
|
out:
|