summaryrefslogtreecommitdiff
path: root/net/packet
diff options
context:
space:
mode:
authorOr Cohen <orcohen@paloaltonetworks.com>2020-09-04 07:05:28 +0300
committerLinus Torvalds <torvalds@linux-foundation.org>2020-09-04 21:56:02 +0300
commitacf69c946233259ab4d64f8869d4037a198c7f06 (patch)
tree45b5adb90a74f16effbdeb788c763e87c47bb84b /net/packet
parentb25d1dc9474e1f0cefca994885e82beea271acfe (diff)
downloadlinux-acf69c946233259ab4d64f8869d4037a198c7f06.tar.xz
net/packet: fix overflow in tpacket_rcv
Using tp_reserve to calculate netoff can overflow as tp_reserve is unsigned int and netoff is unsigned short. This may lead to macoff receving a smaller value then sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr is set, an out-of-bounds write will occur when calling virtio_net_hdr_from_skb. The bug is fixed by converting netoff to unsigned int and checking if it exceeds USHRT_MAX. This addresses CVE-2020-14386 Fixes: 8913336a7e8d ("packet: add PACKET_RESERVE sockopt") Signed-off-by: Or Cohen <orcohen@paloaltonetworks.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'net/packet')
-rw-r--r--net/packet/af_packet.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index da8254e680f9..2b33e977a905 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2170,7 +2170,8 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
int skb_len = skb->len;
unsigned int snaplen, res;
unsigned long status = TP_STATUS_USER;
- unsigned short macoff, netoff, hdrlen;
+ unsigned short macoff, hdrlen;
+ unsigned int netoff;
struct sk_buff *copy_skb = NULL;
struct timespec64 ts;
__u32 ts_status;
@@ -2239,6 +2240,10 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
}
macoff = netoff - maclen;
}
+ if (netoff > USHRT_MAX) {
+ atomic_inc(&po->tp_drops);
+ goto drop_n_restore;
+ }
if (po->tp_version <= TPACKET_V2) {
if (macoff + snaplen > po->rx_ring.frame_size) {
if (po->copy_thresh &&