Commit bc9e2ad4 authored by Eric Dumazet's avatar Eric Dumazet Committed by Ben Hutchings

netlabel: out of bound access in cipso_v4_validate()

commit d71b7896 upstream.

syzkaller found another out of bound access in ip_options_compile(),
or more exactly in cipso_v4_validate()

Fixes: 20e2a864 ("cipso: handle CIPSO options correctly when NetLabel is disabled")
Fixes: 446fda4f ("[NetLabel]: CIPSOv4 engine")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarDmitry Vyukov  <dvyukov@google.com>
Cc: Paul Moore <paul@paul-moore.com>
Acked-by: default avatarPaul Moore <paul@paul-moore.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
parent be16e27d
...@@ -302,6 +302,10 @@ static inline int cipso_v4_validate(const struct sk_buff *skb, ...@@ -302,6 +302,10 @@ static inline int cipso_v4_validate(const struct sk_buff *skb,
} }
for (opt_iter = 6; opt_iter < opt_len;) { for (opt_iter = 6; opt_iter < opt_len;) {
if (opt_iter + 1 == opt_len) {
err_offset = opt_iter;
goto out;
}
tag_len = opt[opt_iter + 1]; tag_len = opt[opt_iter + 1];
if ((tag_len == 0) || (tag_len > (opt_len - opt_iter))) { if ((tag_len == 0) || (tag_len > (opt_len - opt_iter))) {
err_offset = opt_iter + 1; err_offset = opt_iter + 1;
......
...@@ -1645,6 +1645,10 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option) ...@@ -1645,6 +1645,10 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option)
goto validate_return_locked; goto validate_return_locked;
} }
if (opt_iter + 1 == opt_len) {
err_offset = opt_iter;
goto validate_return_locked;
}
tag_len = tag[1]; tag_len = tag[1];
if (tag_len > (opt_len - opt_iter)) { if (tag_len > (opt_len - opt_iter)) {
err_offset = opt_iter + 1; err_offset = opt_iter + 1;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment