From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.2 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,UNWANTED_LANGUAGE_BODY,URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9B009C4363D for ; Fri, 25 Sep 2020 12:53:39 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5A8F721741 for ; Fri, 25 Sep 2020 12:53:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601038419; bh=M+RP/klM8mJ/hXyQDk2kbS5oj9shWR1CNkMe/84/Klk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=moxpj7BZTfzpiwuIIQHrs9iS9eIfxXTnHmb5nOi3cb4GIq3o8M0MFqqse1Ek6IEiX tRFm4pkYbHIy9dkPX3kLQAJANNqaMsze96LLbp81/oE55VPxGoS2ue7E6/1EIBADr7 fJJ/WK4c+PbJgA+hmHpzph5EF3O5w5KGAJjmk3y0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729459AbgIYMxi (ORCPT ); Fri, 25 Sep 2020 08:53:38 -0400 Received: from mail.kernel.org ([198.145.29.99]:59234 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729074AbgIYMxg (ORCPT ); Fri, 25 Sep 2020 08:53:36 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 80BFA2072E; Fri, 25 Sep 2020 12:53:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601038414; bh=M+RP/klM8mJ/hXyQDk2kbS5oj9shWR1CNkMe/84/Klk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=s7U3B6GETcg56nzY1mgy1BZwKsJtKVTdPFkmaNRwlZJCi/23YxyDifHdawJGdsjDK mgGZ4us3KVci9me03QvSavdboJrzLxmEhxFCRkb5FVys+pvWzmfRLUz7t0eHmKo0Ax W70X5eRQFoo5p7eaCtuIcDky+Fc23IKjVp1X0RnA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Salyzyn , netdev@vger.kernel.org, kernel-team@android.com, Steffen Klassert , Herbert Xu , "David S. Miller" , Jakub Kicinski Subject: [PATCH 4.19 01/37] af_key: pfkey_dump needs parameter validation Date: Fri, 25 Sep 2020 14:48:29 +0200 Message-Id: <20200925124721.158581982@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200925124720.972208530@linuxfoundation.org> References: <20200925124720.972208530@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Mark Salyzyn commit 37bd22420f856fcd976989f1d4f1f7ad28e1fcac upstream. In pfkey_dump() dplen and splen can both be specified to access the xfrm_address_t structure out of bounds in__xfrm_state_filter_match() when it calls addr_match() with the indexes. Return EINVAL if either are out of range. Signed-off-by: Mark Salyzyn Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: kernel-team@android.com Cc: Steffen Klassert Cc: Herbert Xu Cc: "David S. Miller" Cc: Jakub Kicinski Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Steffen Klassert Signed-off-by: Greg Kroah-Hartman --- net/key/af_key.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -1855,6 +1855,13 @@ static int pfkey_dump(struct sock *sk, s if (ext_hdrs[SADB_X_EXT_FILTER - 1]) { struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1]; + if ((xfilter->sadb_x_filter_splen >= + (sizeof(xfrm_address_t) << 3)) || + (xfilter->sadb_x_filter_dplen >= + (sizeof(xfrm_address_t) << 3))) { + mutex_unlock(&pfk->dump_lock); + return -EINVAL; + } filter = kmalloc(sizeof(*filter), GFP_KERNEL); if (filter == NULL) { mutex_unlock(&pfk->dump_lock);