From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.2 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,UNWANTED_LANGUAGE_BODY,URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 414DFC4363D for ; Fri, 25 Sep 2020 12:57:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 04DB221741 for ; Fri, 25 Sep 2020 12:57:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601038621; bh=SFKx5C2EQJ7V9toW7OanK7PJteM0Y4ByohNIwnS2J+w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=HZu6ctBJtsD6P2uzKTgg/eZfUvY9llaSvXl4mcikAzwuphHqFCclsq/HhJMMOFuFM xM2OzLKIFy2DSH5430eMYuxvbs5foJa3tctxSyWeb4Oixrrzl3T23/C927wYVAV8wp Zzd7PvSQonwUuxUpUNZYCftk5f736B4TR9CR0WoY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729453AbgIYM47 (ORCPT ); Fri, 25 Sep 2020 08:56:59 -0400 Received: from mail.kernel.org ([198.145.29.99]:55336 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729177AbgIYMvN (ORCPT ); Fri, 25 Sep 2020 08:51:13 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C44382072E; Fri, 25 Sep 2020 12:51:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601038272; bh=SFKx5C2EQJ7V9toW7OanK7PJteM0Y4ByohNIwnS2J+w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oSXPxOqk1iE94EX8bTq35EE0HasToNz/yT+BKBAJ6ZGy+/G3vGY6cH+SMn6oNUdzD SIh9l+K7gm1DxEIKsxkNsnGFPUaHH/JizcJukDpfVgd2d6DQbxUAcnjOf8/yLNvlkO 8sh+QW3w7JbIFdchhp5WfdFqumknFJ2AJ1Rbu/h8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Salyzyn , netdev@vger.kernel.org, kernel-team@android.com, Steffen Klassert , Herbert Xu , "David S. Miller" , Jakub Kicinski Subject: [PATCH 5.4 01/43] af_key: pfkey_dump needs parameter validation Date: Fri, 25 Sep 2020 14:48:13 +0200 Message-Id: <20200925124723.752097958@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200925124723.575329814@linuxfoundation.org> References: <20200925124723.575329814@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Mark Salyzyn commit 37bd22420f856fcd976989f1d4f1f7ad28e1fcac upstream. In pfkey_dump() dplen and splen can both be specified to access the xfrm_address_t structure out of bounds in__xfrm_state_filter_match() when it calls addr_match() with the indexes. Return EINVAL if either are out of range. Signed-off-by: Mark Salyzyn Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: kernel-team@android.com Cc: Steffen Klassert Cc: Herbert Xu Cc: "David S. Miller" Cc: Jakub Kicinski Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Steffen Klassert Signed-off-by: Greg Kroah-Hartman --- net/key/af_key.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -1849,6 +1849,13 @@ static int pfkey_dump(struct sock *sk, s if (ext_hdrs[SADB_X_EXT_FILTER - 1]) { struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1]; + if ((xfilter->sadb_x_filter_splen >= + (sizeof(xfrm_address_t) << 3)) || + (xfilter->sadb_x_filter_dplen >= + (sizeof(xfrm_address_t) << 3))) { + mutex_unlock(&pfk->dump_lock); + return -EINVAL; + } filter = kmalloc(sizeof(*filter), GFP_KERNEL); if (filter == NULL) { mutex_unlock(&pfk->dump_lock);