linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: Steffen Klassert <steffen.klassert@secunet.com>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.9 01/38] xfrm: Validate address prefix lengths in the xfrm selector.
Date: Tue, 16 Oct 2018 00:14:45 -0400	[thread overview]
Message-ID: <20181016041522.135789-1-sashal@kernel.org> (raw)

From: Steffen Klassert <steffen.klassert@secunet.com>

[ Upstream commit 07bf7908950a8b14e81aa1807e3c667eab39287a ]

We don't validate the address prefix lengths in the xfrm
selector we got from userspace. This can lead to undefined
behaviour in the address matching functions if the prefix
is too big for the given address family. Fix this by checking
the prefixes and refuse SA/policy insertation when a prefix
is invalid.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Air Icy <icytxw@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/xfrm/xfrm_user.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 6e768093d7c8..b7ac834a6091 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -151,10 +151,16 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
 	err = -EINVAL;
 	switch (p->family) {
 	case AF_INET:
+		if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
+			goto out;
+
 		break;
 
 	case AF_INET6:
 #if IS_ENABLED(CONFIG_IPV6)
+		if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
+			goto out;
+
 		break;
 #else
 		err = -EAFNOSUPPORT;
@@ -1316,10 +1322,16 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
 
 	switch (p->sel.family) {
 	case AF_INET:
+		if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
+			return -EINVAL;
+
 		break;
 
 	case AF_INET6:
 #if IS_ENABLED(CONFIG_IPV6)
+		if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
+			return -EINVAL;
+
 		break;
 #else
 		return  -EAFNOSUPPORT;
-- 
2.17.1


             reply	other threads:[~2018-10-16  4:15 UTC|newest]

Thread overview: 38+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-10-16  4:14 Sasha Levin [this message]
2018-10-16  4:14 ` [PATCH AUTOSEL 4.9 02/38] xfrm6: call kfree_skb when skb is toobig Sasha Levin
2018-10-16  4:14 ` [PATCH AUTOSEL 4.9 03/38] mac80211: Always report TX status Sasha Levin
2018-10-16  4:14 ` [PATCH AUTOSEL 4.9 04/38] cfg80211: reg: Init wiphy_idx in regulatory_hint_core() Sasha Levin
2018-10-16  4:14 ` [PATCH AUTOSEL 4.9 05/38] mac80211: fix pending queue hang due to TX_DROP Sasha Levin
2018-10-16  4:14 ` [PATCH AUTOSEL 4.9 06/38] cfg80211: Address some corner cases in scan result channel updating Sasha Levin
2018-10-16  4:14 ` [PATCH AUTOSEL 4.9 07/38] mac80211: TDLS: fix skb queue/priority assignment Sasha Levin
2018-10-16  4:14 ` [PATCH AUTOSEL 4.9 08/38] ARM: 8799/1: mm: fix pci_ioremap_io() offset check Sasha Levin
2018-10-16  4:14 ` [PATCH AUTOSEL 4.9 09/38] xfrm: validate template mode Sasha Levin
2018-10-16  4:14 ` [PATCH AUTOSEL 4.9 10/38] ARM: dts: BCM63xx: Fix incorrect interrupt specifiers Sasha Levin
2018-10-16  4:14 ` [PATCH AUTOSEL 4.9 11/38] net: macb: Clean 64b dma addresses if they are not detected Sasha Levin
2018-10-16  4:14 ` [PATCH AUTOSEL 4.9 12/38] net: hns: fix for unmapping problem when SMMU is on Sasha Levin
2018-10-16  4:14 ` [PATCH AUTOSEL 4.9 13/38] soc: fsl: qbman: qman: avoid allocating from non existing gen_pool Sasha Levin
2018-10-16  4:14 ` [PATCH AUTOSEL 4.9 14/38] soc: fsl: qe: Fix copy/paste bug in ucc_get_tdm_sync_shift() Sasha Levin
2018-10-16  4:14 ` [PATCH AUTOSEL 4.9 15/38] nl80211: Fix possible Spectre-v1 for NL80211_TXRATE_HT Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 16/38] mac80211_hwsim: do not omit multicast announce of first added radio Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 17/38] Bluetooth: SMP: fix crash in unpairing Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 18/38] pxa168fb: prepare the clock Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 19/38] qed: Avoid implicit enum conversion in qed_roce_mode_to_flavor Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 20/38] bonding: avoid possible dead-lock Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 21/38] qed: Avoid constant logical operation warning in qed_vf_pf_acquire Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 22/38] bnxt_en: Fix TX timeout during netpoll Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 23/38] asix: Check for supported Wake-on-LAN modes Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 24/38] ax88179_178a: " Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 25/38] lan78xx: " Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 26/38] sr9800: " Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 27/38] r8152: Check for supported Wake-on-LAN Modes Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 28/38] smsc75xx: Check for Wake-on-LAN modes Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 29/38] smsc95xx: " Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 30/38] qlcnic: fix Tx descriptor corruption on 82xx devices Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 31/38] i2c: i2c-scmi: fix for i2c_smbus_write_block_data Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 32/38] perf/ring_buffer: Prevent concurent ring buffer access Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 33/38] perf/x86/intel/uncore: Fix PCI BDF address of M3UPI on SKX Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 34/38] net: fec: fix rare tx timeout Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 35/38] declance: Fix continuation with the adapter identification message Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 36/38] net/usb: cancel pending work when unbinding smsc75xx Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 37/38] net: cxgb3_main: fix a missing-check bug Sasha Levin
2018-10-16  4:15 ` [PATCH AUTOSEL 4.9 38/38] mm/vmstat.c: fix outdated vmstat_text Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20181016041522.135789-1-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=steffen.klassert@secunet.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).