linux-stable/include
Patrick McHardy 4717ecd49c [PATCH] Fix signedness issues in net/core/filter.c
This is the code to load packet data into a register:

                        k = fentry->k;
                        if (k < 0) {
...
                        } else {
                                u32 _tmp, *p;
                                p = skb_header_pointer(skb, k, 4, &_tmp);
                                if (p != NULL) {
                                        A = ntohl(*p);
                                        continue;
                                }
                        }

skb_header_pointer checks if the requested data is within the
linear area:

        int hlen = skb_headlen(skb);

        if (offset + len <= hlen)
                return skb->data + offset;

When offset is within [INT_MAX-len+1..INT_MAX] the addition will
result in a negative number which is <= hlen.

I couldn't trigger a crash on my AMD64 with 2GB of memory, but a
coworker tried on his x86 machine and it crashed immediately.

This patch fixes the check in skb_header_pointer to handle large
positive offsets similar to skb_copy_bits. Invalid data can still
be accessed using negative offsets (also similar to skb_copy_bits),
anyone using negative offsets needs to verify them himself.

Thanks to Thomas Vögtle <thomas.voegtle@coreworks.de> for verifying the
problem by crashing his machine and providing me with an Oops.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-08-05 00:04:17 -07:00
..
acpi Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
asm-alpha [PATCH] AGP fix for Xen VMM 2005-06-07 12:35:43 -07:00
asm-arm [PATCH] ARM: 2714/1: Fix the IB2 definitions for the Versatile platform 2005-06-16 18:01:12 +01:00
asm-arm26 [PATCH] Remove obsolete HAVE_ARCH_GET_SIGNAL_TO_DELIVER? 2005-06-12 20:43:21 -07:00
asm-cris [PATCH] asm/signal.h unification 2005-05-04 07:33:15 -07:00
asm-frv [PATCH] asm/signal.h unification 2005-05-04 07:33:15 -07:00
asm-generic [PATCH] ppc32: platform-specific functions missing from kallsyms. 2005-05-05 16:36:31 -07:00
asm-h8300 [PATCH] h8300 build error fix 2005-06-06 14:42:23 -07:00
asm-i386 [PATCH] Add "memory" clobbers to the x86 inline asm of strncmp and friends 2005-06-29 16:00:38 -07:00
asm-ia64 [PATCH] ia64: fix floating-point preemption problem 2005-06-08 16:21:14 -07:00
asm-m32r [PATCH] asm/signal.h unification 2005-05-04 07:33:15 -07:00
asm-m68k [PATCH] asm/signal.h unification 2005-05-04 07:33:15 -07:00
asm-m68knommu [PATCH] asm/signal.h unification 2005-05-04 07:33:15 -07:00
asm-mips [PATCH] asm/signal.h unification 2005-05-04 07:33:15 -07:00
asm-parisc [PATCH] make some things static 2005-05-05 16:36:47 -07:00
asm-ppc [PATCH] AGP fix for Xen VMM 2005-06-07 12:35:43 -07:00
asm-ppc64 [PATCH] ppc64: Fix PER_LINUX32 behaviour 2005-06-08 16:24:15 -07:00
asm-s390 [PATCH] s390: uml ptrace fixes 2005-06-04 17:13:00 -07:00
asm-sh [PATCH] sh: PREEMPT_ACTIVE fix 2005-05-28 16:46:13 -07:00
asm-sh64 [PATCH] sh: PREEMPT_ACTIVE fix 2005-05-28 16:46:13 -07:00
asm-sparc [PATCH] sparc32: silence access_ok() warnings 2005-06-08 16:21:13 -07:00
asm-sparc64 [PATCH] AGP fix for Xen VMM 2005-06-07 12:35:43 -07:00
asm-um [PATCH] uml: remove jail mode + other leftovers 2005-05-28 16:46:14 -07:00
asm-v850 [PATCH] asm/signal.h unification 2005-05-04 07:33:15 -07:00
asm-x86_64 [PATCH] AGP fix for Xen VMM 2005-06-07 12:35:43 -07:00
linux [PATCH] Fix signedness issues in net/core/filter.c 2005-08-05 00:04:17 -07:00
math-emu Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
media [PATCH] dvb: modified dvb_register_adapter() to avoid kmalloc/kfree 2005-05-17 07:59:33 -07:00
mtd Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
net [SCTP] Add support for ip_nonlocal_bind sysctl & IP_FREEBIND socket option 2005-06-13 15:12:33 -07:00
pcmcia Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
rxrpc Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
scsi [SCSI] implement parameter limits in the SPI transport class 2005-05-20 15:54:32 -05:00
sound Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
video [PATCH] Clean-up and bug fix for tdfxfb framebuffer size detection 2005-05-01 08:59:25 -07:00