From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.7 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,UNWANTED_LANGUAGE_BODY,URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 86EE3C4727C for ; Tue, 29 Sep 2020 11:12:43 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 324EB21D41 for ; Tue, 29 Sep 2020 11:12:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601377963; bh=M+RP/klM8mJ/hXyQDk2kbS5oj9shWR1CNkMe/84/Klk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Dyb2iraQ+T0yPqm6bi8acsSHKXE+0OaOeNNrqHOCqXbPzucaV0piZTeQ8c6c8d//g 449ANNUXrooxfXuQVVK5TxOaS3ujjwiFr9c8NYCJvDygn5DZdGCBxjvbBOjKciFs6o 5XnL1TJDP/3ns5odsb9ISMXHZVDu37TFra1/EK+8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729329AbgI2LMe (ORCPT ); Tue, 29 Sep 2020 07:12:34 -0400 Received: from mail.kernel.org ([198.145.29.99]:54274 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729043AbgI2LM3 (ORCPT ); Tue, 29 Sep 2020 07:12:29 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D1E1D206A5; Tue, 29 Sep 2020 11:12:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1601377948; bh=M+RP/klM8mJ/hXyQDk2kbS5oj9shWR1CNkMe/84/Klk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fnHl89QZqO1kie87BNLJYg+1Hq5vqEInxGqx5WapI0cDKEdXNWuOgUW85daAS9MHr QYmnD+TD8ztcu3Akmb8uozUJlxFu5X6eCUANQrzauX62HjwIYm354+KBI7NsRbO1WT IIgFBEetxDTEbFNtK6Ak1uY4w2EsWTi8s03SFzPs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Salyzyn , netdev@vger.kernel.org, kernel-team@android.com, Steffen Klassert , Herbert Xu , "David S. Miller" , Jakub Kicinski Subject: [PATCH 4.14 001/166] af_key: pfkey_dump needs parameter validation Date: Tue, 29 Sep 2020 12:58:33 +0200 Message-Id: <20200929105935.259945570@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200929105935.184737111@linuxfoundation.org> References: <20200929105935.184737111@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Mark Salyzyn commit 37bd22420f856fcd976989f1d4f1f7ad28e1fcac upstream. In pfkey_dump() dplen and splen can both be specified to access the xfrm_address_t structure out of bounds in__xfrm_state_filter_match() when it calls addr_match() with the indexes. Return EINVAL if either are out of range. Signed-off-by: Mark Salyzyn Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: kernel-team@android.com Cc: Steffen Klassert Cc: Herbert Xu Cc: "David S. Miller" Cc: Jakub Kicinski Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Steffen Klassert Signed-off-by: Greg Kroah-Hartman --- net/key/af_key.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -1855,6 +1855,13 @@ static int pfkey_dump(struct sock *sk, s if (ext_hdrs[SADB_X_EXT_FILTER - 1]) { struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1]; + if ((xfilter->sadb_x_filter_splen >= + (sizeof(xfrm_address_t) << 3)) || + (xfilter->sadb_x_filter_dplen >= + (sizeof(xfrm_address_t) << 3))) { + mutex_unlock(&pfk->dump_lock); + return -EINVAL; + } filter = kmalloc(sizeof(*filter), GFP_KERNEL); if (filter == NULL) { mutex_unlock(&pfk->dump_lock);