From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1949683AbdDYUgU (ORCPT ); Tue, 25 Apr 2017 16:36:20 -0400 Received: from mx1.redhat.com ([209.132.183.28]:38912 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1949099AbdDYUgB (ORCPT ); Tue, 25 Apr 2017 16:36:01 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 047A7C059733 Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=queasysnail.net Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; spf=none smtp.mailfrom=sd@queasysnail.net DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 047A7C059733 Date: Tue, 25 Apr 2017 22:35:55 +0200 From: Sabrina Dubroca To: "Jason A. Donenfeld" Cc: Netdev , LKML , David Miller , stable@vger.kernel.org, security@kernel.org Subject: Re: [PATCH v2] macsec: dynamically allocate space for sglist Message-ID: <20170425203555.GA9378@bistromath.localdomain> References: <20170425163602.GA17973@bistromath.localdomain> <20170425170818.32661-1-Jason@zx2c4.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20170425170818.32661-1-Jason@zx2c4.com> User-Agent: Mutt/1.8.2 (2017-04-18) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Tue, 25 Apr 2017 20:36:00 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 2017-04-25, 19:08:18 +0200, Jason A. Donenfeld wrote: > We call skb_cow_data, which is good anyway to ensure we can actually > modify the skb as such (another error from prior). Now that we have the > number of fragments required, we can safely allocate exactly that amount > of memory. > > Signed-off-by: Jason A. Donenfeld > Cc: Sabrina Dubroca > Cc: security@kernel.org > Cc: stable@vger.kernel.org Acked-by: Sabrina Dubroca Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Fixes: CVE-2017-7477 David, this fix is essentially equivalent to my patch "macsec: avoid heap overflow in skb_to_sgvec on receive". Feel free to pick my patch if you prefer (it's smaller), but this looks ok to me. Thanks, -- Sabrina