1. 05 Jul, 2005 1 commit
    • Patrick McHardy's avatar
      [NET]: Fix signedness issues in net/core/filter.c · 55820ee2
      Patrick McHardy authored
      This is the code to load packet data into a register:
      
                              k = fentry->k;
                              if (k < 0) {
      ...
                              } else {
                                      u32 _tmp, *p;
                                      p = skb_header_pointer(skb, k, 4, &_tmp);
                                      if (p != NULL) {
                                              A = ntohl(*p);
                                              continue;
                                      }
                              }
      
      skb_header_pointer checks if the requested data is within the
      linear area:
      
              int hlen = skb_headlen(skb);
      
              if (offset + len <= hlen)
                      return skb->data + offset;
      
      When offset is within [INT_MAX-len+1..INT_MAX] the addition will
      result in a negative number which is <= hlen.
      
      I couldn't trigger a crash on my AMD64 with 2GB of memory, but a
      coworker tried on his x86 machine and it crashed immediately.
      
      This patch fixes the check in skb_header_pointer to handle large
      positive offsets similar to skb_copy_bits. Invalid data can still
      be accessed using negative offsets (also similar to skb_copy_bits),
      anyone using negative offsets needs to verify them himself.
      
      Thanks to Thomas Vögtle <thomas.voegtle@coreworks.de> for verifying the
      problem by crashing his machine and providing me with an Oops.
      Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
      Acked-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      55820ee2
  2. 04 Jul, 2005 3 commits
  3. 03 Jul, 2005 21 commits
  4. 02 Jul, 2005 3 commits
  5. 01 Jul, 2005 12 commits