diff options
author | Neal Cardwell <ncardwell@google.com> | 2012-12-08 14:43:22 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2012-12-09 18:59:37 -0500 |
commit | 405c005949e47b6e91359159c24753519ded0c67 (patch) | |
tree | 0bc2ce5536a6c72a668319559099b2b3fad1debe /net/ipv4 | |
parent | 1c95df85ca49640576de2f0a850925957b547b84 (diff) |
inet_diag: validate byte code to prevent oops in inet_diag_bc_run()
Add logic to validate INET_DIAG_BC_S_COND and INET_DIAG_BC_D_COND
operations.
Previously we did not validate the inet_diag_hostcond, address family,
address length, and prefix length. So a malicious user could make the
kernel read beyond the end of the bytecode array by claiming to have a
whole inet_diag_hostcond when the bytecode was not long enough to
contain a whole inet_diag_hostcond of the given address family. Or
they could make the kernel read up to about 27 bytes beyond the end of
a connection address by passing a prefix length that exceeded the
length of addresses of the given family.
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4')
-rw-r--r-- | net/ipv4/inet_diag.c | 48 |
1 files changed, 45 insertions, 3 deletions
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c index 16cfa42cfd99..529747d07a2a 100644 --- a/net/ipv4/inet_diag.c +++ b/net/ipv4/inet_diag.c | |||
@@ -513,6 +513,44 @@ static int valid_cc(const void *bc, int len, int cc) | |||
513 | return 0; | 513 | return 0; |
514 | } | 514 | } |
515 | 515 | ||
516 | /* Validate an inet_diag_hostcond. */ | ||
517 | static bool valid_hostcond(const struct inet_diag_bc_op *op, int len, | ||
518 | int *min_len) | ||
519 | { | ||
520 | int addr_len; | ||
521 | struct inet_diag_hostcond *cond; | ||
522 | |||
523 | /* Check hostcond space. */ | ||
524 | *min_len += sizeof(struct inet_diag_hostcond); | ||
525 | if (len < *min_len) | ||
526 | return false; | ||
527 | cond = (struct inet_diag_hostcond *)(op + 1); | ||
528 | |||
529 | /* Check address family and address length. */ | ||
530 | switch (cond->family) { | ||
531 | case AF_UNSPEC: | ||
532 | addr_len = 0; | ||
533 | break; | ||
534 | case AF_INET: | ||
535 | addr_len = sizeof(struct in_addr); | ||
536 | break; | ||
537 | case AF_INET6: | ||
538 | addr_len = sizeof(struct in6_addr); | ||
539 | break; | ||
540 | default: | ||
541 | return false; | ||
542 | } | ||
543 | *min_len += addr_len; | ||
544 | if (len < *min_len) | ||
545 | return false; | ||
546 | |||
547 | /* Check prefix length (in bits) vs address length (in bytes). */ | ||
548 | if (cond->prefix_len > 8 * addr_len) | ||
549 | return false; | ||
550 | |||
551 | return true; | ||
552 | } | ||
553 | |||
516 | static int inet_diag_bc_audit(const void *bytecode, int bytecode_len) | 554 | static int inet_diag_bc_audit(const void *bytecode, int bytecode_len) |
517 | { | 555 | { |
518 | const void *bc = bytecode; | 556 | const void *bc = bytecode; |
@@ -520,18 +558,22 @@ static int inet_diag_bc_audit(const void *bytecode, int bytecode_len) | |||
520 | 558 | ||
521 | while (len > 0) { | 559 | while (len > 0) { |
522 | const struct inet_diag_bc_op *op = bc; | 560 | const struct inet_diag_bc_op *op = bc; |
561 | int min_len = sizeof(struct inet_diag_bc_op); | ||
523 | 562 | ||
524 | //printk("BC: %d %d %d {%d} / %d\n", op->code, op->yes, op->no, op[1].no, len); | 563 | //printk("BC: %d %d %d {%d} / %d\n", op->code, op->yes, op->no, op[1].no, len); |
525 | switch (op->code) { | 564 | switch (op->code) { |
526 | case INET_DIAG_BC_AUTO: | ||
527 | case INET_DIAG_BC_S_COND: | 565 | case INET_DIAG_BC_S_COND: |
528 | case INET_DIAG_BC_D_COND: | 566 | case INET_DIAG_BC_D_COND: |
567 | if (!valid_hostcond(bc, len, &min_len)) | ||
568 | return -EINVAL; | ||
569 | /* fall through */ | ||
570 | case INET_DIAG_BC_AUTO: | ||
529 | case INET_DIAG_BC_S_GE: | 571 | case INET_DIAG_BC_S_GE: |
530 | case INET_DIAG_BC_S_LE: | 572 | case INET_DIAG_BC_S_LE: |
531 | case INET_DIAG_BC_D_GE: | 573 | case INET_DIAG_BC_D_GE: |
532 | case INET_DIAG_BC_D_LE: | 574 | case INET_DIAG_BC_D_LE: |
533 | case INET_DIAG_BC_JMP: | 575 | case INET_DIAG_BC_JMP: |
534 | if (op->no < 4 || op->no > len + 4 || op->no & 3) | 576 | if (op->no < min_len || op->no > len + 4 || op->no & 3) |
535 | return -EINVAL; | 577 | return -EINVAL; |
536 | if (op->no < len && | 578 | if (op->no < len && |
537 | !valid_cc(bytecode, bytecode_len, len - op->no)) | 579 | !valid_cc(bytecode, bytecode_len, len - op->no)) |
@@ -542,7 +584,7 @@ static int inet_diag_bc_audit(const void *bytecode, int bytecode_len) | |||
542 | default: | 584 | default: |
543 | return -EINVAL; | 585 | return -EINVAL; |
544 | } | 586 | } |
545 | if (op->yes < 4 || op->yes > len + 4 || op->yes & 3) | 587 | if (op->yes < min_len || op->yes > len + 4 || op->yes & 3) |
546 | return -EINVAL; | 588 | return -EINVAL; |
547 | bc += op->yes; | 589 | bc += op->yes; |
548 | len -= op->yes; | 590 | len -= op->yes; |