* [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open()
@ 2015-10-14 17:51 Ben Hutchings
2015-10-14 17:53 ` [PATCH 2/2] ppp, slip: Validate VJ compression slot parameters completely Ben Hutchings
2015-10-16 7:46 ` [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() David Miller
0 siblings, 2 replies; 6+ messages in thread
From: Ben Hutchings @ 2015-10-14 17:51 UTC (permalink / raw)
To: David Miller; +Cc: Karsten Keil, linux-ppp, netdev
[-- Attachment #1: Type: text/plain, Size: 1166 bytes --]
Compile-tested only.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/isdn/i4l/isdn_ppp.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index c4198fa..86f9abe 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -301,6 +301,8 @@ isdn_ppp_open(int min, struct file *file)
is->compflags = 0;
is->reset = isdn_ppp_ccp_reset_alloc(is);
+ if (!is->reset)
+ return -ENOMEM;
is->lp = NULL;
is->mp_seqno = 0; /* MP sequence number */
@@ -320,6 +322,10 @@ isdn_ppp_open(int min, struct file *file)
* VJ header compression init
*/
is->slcomp = slhc_init(16, 16); /* not necessary for 2. link in bundle */
+ if (!is->slcomp) {
+ isdn_ppp_ccp_reset_free(is);
+ return -ENOMEM;
+ }
#endif
#ifdef CONFIG_IPPP_FILTER
is->pass_filter = NULL;
--
Ben Hutchings
[W]e found...that it wasn't as easy to get programs right as we had thought.
... I realized that a large part of my life from then on was going to be spent
in finding mistakes in my own programs. - Maurice Wilkes, 1949
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 811 bytes --]
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/2] ppp, slip: Validate VJ compression slot parameters completely
2015-10-14 17:51 [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() Ben Hutchings
@ 2015-10-14 17:53 ` Ben Hutchings
2015-10-16 7:46 ` [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() David Miller
1 sibling, 0 replies; 6+ messages in thread
From: Ben Hutchings @ 2015-10-14 17:53 UTC (permalink / raw)
To: David Miller; +Cc: Karsten Keil, linux-ppp, netdev, 郭永刚
[-- Attachment #1: Type: text/plain, Size: 4500 bytes --]
Currently slhc_init() treats out-of-range values of rslots and tslots
as equivalent to 0, except that if tslots is too large it will
dereference a null pointer (CVE-2015-7799).
Add a range-check at the top of the function and make it return an
ERR_PTR() on error instead of NULL. Change the callers accordingly.
Compile-tested only.
Reported-by: 郭永刚 <guoyonggang@360.cn>
References: http://article.gmane.org/gmane.comp.security.oss.general/17908
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/isdn/i4l/isdn_ppp.c | 10 ++++------
drivers/net/ppp/ppp_generic.c | 6 ++----
drivers/net/slip/slhc.c | 12 ++++++++----
drivers/net/slip/slip.c | 2 +-
4 files changed, 15 insertions(+), 15 deletions(-)
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index 86f9abe..9c1e8ad 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -322,9 +322,9 @@ isdn_ppp_open(int min, struct file *file)
* VJ header compression init
*/
is->slcomp = slhc_init(16, 16); /* not necessary for 2. link in bundle */
- if (!is->slcomp) {
+ if (IS_ERR(is->slcomp)) {
isdn_ppp_ccp_reset_free(is);
- return -ENOMEM;
+ return PTR_ERR(is->slcomp);
}
#endif
#ifdef CONFIG_IPPP_FILTER
@@ -573,10 +573,8 @@ isdn_ppp_ioctl(int min, struct file *file, unsigned int cmd, unsigned long arg)
is->maxcid = val;
#ifdef CONFIG_ISDN_PPP_VJ
sltmp = slhc_init(16, val);
- if (!sltmp) {
- printk(KERN_ERR "ippp, can't realloc slhc struct\n");
- return -ENOMEM;
- }
+ if (IS_ERR(sltmp))
+ return PTR_ERR(sltmp);
if (is->slcomp)
slhc_free(is->slcomp);
is->slcomp = sltmp;
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index ed00446..9a863c6 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -721,10 +721,8 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
val &= 0xffff;
}
vj = slhc_init(val2+1, val+1);
- if (!vj) {
- netdev_err(ppp->dev,
- "PPP: no memory (VJ compressor)\n");
- err = -ENOMEM;
+ if (IS_ERR(vj)) {
+ err = PTR_ERR(vj);
break;
}
ppp_lock(ppp);
diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
index 079f7ad..27ed252 100644
--- a/drivers/net/slip/slhc.c
+++ b/drivers/net/slip/slhc.c
@@ -84,8 +84,9 @@ static long decode(unsigned char **cpp);
static unsigned char * put16(unsigned char *cp, unsigned short x);
static unsigned short pull16(unsigned char **cpp);
-/* Initialize compression data structure
+/* Allocate compression data structure
* slots must be in range 0 to 255 (zero meaning no compression)
+ * Returns pointer to structure or ERR_PTR() on error.
*/
struct slcompress *
slhc_init(int rslots, int tslots)
@@ -94,11 +95,14 @@ slhc_init(int rslots, int tslots)
register struct cstate *ts;
struct slcompress *comp;
+ if (rslots < 0 || rslots > 255 || tslots < 0 || tslots > 255)
+ return ERR_PTR(-EINVAL);
+
comp = kzalloc(sizeof(struct slcompress), GFP_KERNEL);
if (! comp)
goto out_fail;
- if ( rslots > 0 && rslots < 256 ) {
+ if (rslots > 0) {
size_t rsize = rslots * sizeof(struct cstate);
comp->rstate = kzalloc(rsize, GFP_KERNEL);
if (! comp->rstate)
@@ -106,7 +110,7 @@ slhc_init(int rslots, int tslots)
comp->rslot_limit = rslots - 1;
}
- if ( tslots > 0 && tslots < 256 ) {
+ if (tslots > 0) {
size_t tsize = tslots * sizeof(struct cstate);
comp->tstate = kzalloc(tsize, GFP_KERNEL);
if (! comp->tstate)
@@ -141,7 +145,7 @@ out_free2:
out_free:
kfree(comp);
out_fail:
- return NULL;
+ return ERR_PTR(-ENOMEM);
}
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index 05387b1..a17d86a 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -164,7 +164,7 @@ static int sl_alloc_bufs(struct slip *sl, int mtu)
if (cbuff == NULL)
goto err_exit;
slcomp = slhc_init(16, 16);
- if (slcomp == NULL)
+ if (IS_ERR(slcomp))
goto err_exit;
#endif
spin_lock_bh(&sl->lock);
--
Ben Hutchings
[W]e found...that it wasn't as easy to get programs right as we had thought.
... I realized that a large part of my life from then on was going to be spent
in finding mistakes in my own programs. - Maurice Wilkes, 1949
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 811 bytes --]
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open()
2015-10-14 17:51 [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() Ben Hutchings
2015-10-14 17:53 ` [PATCH 2/2] ppp, slip: Validate VJ compression slot parameters completely Ben Hutchings
@ 2015-10-16 7:46 ` David Miller
2015-10-30 13:03 ` Josh Boyer
2015-11-01 16:23 ` Ben Hutchings
1 sibling, 2 replies; 6+ messages in thread
From: David Miller @ 2015-10-16 7:46 UTC (permalink / raw)
To: ben; +Cc: isdn, linux-ppp, netdev
From: Ben Hutchings <ben@decadent.org.uk>
Date: Wed, 14 Oct 2015 18:51:14 +0100
> Compile-tested only.
>
> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
> ---
> drivers/isdn/i4l/isdn_ppp.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
> index c4198fa..86f9abe 100644
> --- a/drivers/isdn/i4l/isdn_ppp.c
> +++ b/drivers/isdn/i4l/isdn_ppp.c
> @@ -301,6 +301,8 @@ isdn_ppp_open(int min, struct file *file)
> is->compflags = 0;
>
> is->reset = isdn_ppp_ccp_reset_alloc(is);
> + if (!is->reset)
> + return -ENOMEM;
Ben, your email client has corrupted both of these patches.
Please fix this up and resubmit, thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open()
2015-10-16 7:46 ` [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() David Miller
@ 2015-10-30 13:03 ` Josh Boyer
2015-11-01 16:23 ` Ben Hutchings
2015-11-01 16:23 ` Ben Hutchings
1 sibling, 1 reply; 6+ messages in thread
From: Josh Boyer @ 2015-10-30 13:03 UTC (permalink / raw)
To: Ben Hutchings; +Cc: isdn, David Miller, linux-ppp, netdev
On Fri, Oct 16, 2015 at 3:46 AM, David Miller <davem@davemloft.net> wrote:
> From: Ben Hutchings <ben@decadent.org.uk>
> Date: Wed, 14 Oct 2015 18:51:14 +0100
>
>> Compile-tested only.
>>
>> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
>> ---
>> drivers/isdn/i4l/isdn_ppp.c | 6 ++++++
>> 1 file changed, 6 insertions(+)
>>
>> diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
>> index c4198fa..86f9abe 100644
>> --- a/drivers/isdn/i4l/isdn_ppp.c
>> +++ b/drivers/isdn/i4l/isdn_ppp.c
>> @@ -301,6 +301,8 @@ isdn_ppp_open(int min, struct file *file)
>> is->compflags = 0;
>>
>> is->reset = isdn_ppp_ccp_reset_alloc(is);
>> + if (!is->reset)
>> + return -ENOMEM;
>
> Ben, your email client has corrupted both of these patches.
>
> Please fix this up and resubmit, thanks.
Ben, did you resubmit these as David suggested? I haven't found a v2 anywhere.
josh
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open()
2015-10-16 7:46 ` [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() David Miller
2015-10-30 13:03 ` Josh Boyer
@ 2015-11-01 16:23 ` Ben Hutchings
1 sibling, 0 replies; 6+ messages in thread
From: Ben Hutchings @ 2015-11-01 16:23 UTC (permalink / raw)
To: David Miller; +Cc: isdn, linux-ppp, netdev
[-- Attachment #1: Type: text/plain, Size: 1055 bytes --]
On Fri, 2015-10-16 at 00:46 -0700, David Miller wrote:
> From: Ben Hutchings <ben@decadent.org.uk>
> Date: Wed, 14 Oct 2015 18:51:14 +0100
>
> > Compile-tested only.
> >
> > Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
> > ---
> > drivers/isdn/i4l/isdn_ppp.c | 6 ++++++
> > 1 file changed, 6 insertions(+)
> >
> > diff --git a/drivers/isdn/i4l/isdn_ppp.c
> b/drivers/isdn/i4l/isdn_ppp.c
> > index c4198fa..86f9abe 100644
> > --- a/drivers/isdn/i4l/isdn_ppp.c
> > +++ b/drivers/isdn/i4l/isdn_ppp.c
> > @@ -301,6 +301,8 @@ isdn_ppp_open(int min, struct file *file)
> > is->compflags = 0;
> >
> > is->reset = isdn_ppp_ccp_reset_alloc(is);
> > + if (!is->reset)
> > + return -ENOMEM;
>
> Ben, your email client has corrupted both of these patches.
>
> Please fix this up and resubmit, thanks.
Sorry about that; it is a regression in Evolution 3.18.
Ben.
--
Ben Hutchings
Nothing is ever a complete failure; it can always serve as a bad example.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 811 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open()
2015-10-30 13:03 ` Josh Boyer
@ 2015-11-01 16:23 ` Ben Hutchings
0 siblings, 0 replies; 6+ messages in thread
From: Ben Hutchings @ 2015-11-01 16:23 UTC (permalink / raw)
To: Josh Boyer; +Cc: isdn, David Miller, linux-ppp, netdev
[-- Attachment #1: Type: text/plain, Size: 1239 bytes --]
On Fri, 2015-10-30 at 09:03 -0400, Josh Boyer wrote:
> On Fri, Oct 16, 2015 at 3:46 AM, David Miller <davem@davemloft.net>
> wrote:
> > From: Ben Hutchings <ben@decadent.org.uk>
> > Date: Wed, 14 Oct 2015 18:51:14 +0100
> >
> > > Compile-tested only.
> > >
> > > Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
> > > ---
> > > drivers/isdn/i4l/isdn_ppp.c | 6 ++++++
> > > 1 file changed, 6 insertions(+)
> > >
> > > diff --git a/drivers/isdn/i4l/isdn_ppp.c
> > > b/drivers/isdn/i4l/isdn_ppp.c
> > > index c4198fa..86f9abe 100644
> > > --- a/drivers/isdn/i4l/isdn_ppp.c
> > > +++ b/drivers/isdn/i4l/isdn_ppp.c
> > > @@ -301,6 +301,8 @@ isdn_ppp_open(int min, struct file *file)
> > > is->compflags = 0;
> > >
> > > is->reset = isdn_ppp_ccp_reset_alloc(is);
> > > + if (!is->reset)
> > > + return -ENOMEM;
> >
> > Ben, your email client has corrupted both of these patches.
> >
> > Please fix this up and resubmit, thanks.
>
> Ben, did you resubmit these as David suggested? I haven't found a v2
> anywhere.
I've just done so.
Ben.
--
Ben Hutchings
Nothing is ever a complete failure; it can always serve as a bad example.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 811 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2015-11-01 16:23 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-10-14 17:51 [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() Ben Hutchings
2015-10-14 17:53 ` [PATCH 2/2] ppp, slip: Validate VJ compression slot parameters completely Ben Hutchings
2015-10-16 7:46 ` [PATCH net 1/2] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() David Miller
2015-10-30 13:03 ` Josh Boyer
2015-11-01 16:23 ` Ben Hutchings
2015-11-01 16:23 ` Ben Hutchings
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).