From: Matthieu Baerts <matthieu.baerts@tessares.net>
To: Mat Martineau <mathew.j.martineau@linux.intel.com>
Cc: Maxim Mikityanskiy <maximmi@nvidia.com>, mptcp@lists.linux.dev
Subject: Re: [PATCH net v2 2/3] mptcp: Fix out of bounds when parsing TCP options
Date: Fri, 11 Jun 2021 16:30:03 +0200 [thread overview]
Message-ID: <3643daa0-fb33-5061-ee8f-546b8ac5823e@tessares.net> (raw)
In-Reply-To: <82474768-2c86-b2b7-afeb-30618b2ce094@linux.intel.com>
Hi Mat,
On 10/06/2021 23:03, Mat Martineau wrote:
> On Thu, 10 Jun 2021, Maxim Mikityanskiy wrote:
>
>> The TCP option parser in mptcp (mptcp_get_options) could read one byte
>> out of bounds. When the length is 1, the execution flow gets into the
>> loop, reads one byte of the opcode, and if the opcode is neither
>> TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the
>> length of 1.
>>
>> This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stack
>> out of bounds when parsing TCP options.").
>>
>> Cc: Young Xiao <92siuyang@gmail.com>
>> Fixes: cec37a6e41aa ("mptcp: Handle MP_CAPABLE options for outgoing
>> connections")
>> Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
>> Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
>
> Matthieu -
>
> Could you apply this in mptcp_net-next so it's easier to track when the
> patch finds its way to net-next?
Sure, good idea!
Thank you for the patch and the review!
Just applied in our tree:
- fdd037a5564a: mptcp: Fix out of bounds when parsing TCP options
- Results: 083034593cec..1ba3eb627299
Builds and tests are now in progress:
https://cirrus-ci.com/github/multipath-tcp/mptcp_net-next/export/20210611T142646
https://github.com/multipath-tcp/mptcp_net-next/actions/workflows/build-validation.yml?query=branch:export/20210611T142646
Cheers,
Matt
--
Tessares | Belgium | Hybrid Access Solutions
www.tessares.net
next prev parent reply other threads:[~2021-06-11 14:30 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-10 16:40 [PATCH net v2 0/3] Fix out of bounds when parsing TCP options Maxim Mikityanskiy
2021-06-10 16:40 ` [PATCH net v2 1/3] netfilter: synproxy: " Maxim Mikityanskiy
2021-06-10 16:43 ` Florian Westphal
2021-06-10 16:40 ` [PATCH net v2 2/3] mptcp: " Maxim Mikityanskiy
2021-06-10 21:03 ` Mat Martineau
2021-06-10 21:09 ` Mat Martineau
2021-06-11 14:30 ` Matthieu Baerts [this message]
2021-06-10 16:40 ` [PATCH net v2 3/3] sch_cake: Fix out of bounds when parsing TCP options and header Maxim Mikityanskiy
2021-06-10 21:50 ` [PATCH net v2 0/3] Fix out of bounds when parsing TCP options patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3643daa0-fb33-5061-ee8f-546b8ac5823e@tessares.net \
--to=matthieu.baerts@tessares.net \
--cc=mathew.j.martineau@linux.intel.com \
--cc=maximmi@nvidia.com \
--cc=mptcp@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).