Message ID | 20221203094635.29024-1-yuehaibing@huawei.com |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp1291032wrr; Sat, 3 Dec 2022 01:55:26 -0800 (PST) X-Google-Smtp-Source: AA0mqf6oT8Ubo/k8IcZtF99joF5egMcyAA42axmr8WJzPA25/HnoirUg7v3aSGX0fMqbE2uEsveB X-Received: by 2002:a63:4e4c:0:b0:46f:dc59:aab6 with SMTP id o12-20020a634e4c000000b0046fdc59aab6mr67920752pgl.35.1670061326061; Sat, 03 Dec 2022 01:55:26 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1670061326; cv=none; d=google.com; s=arc-20160816; b=qYRxUHCh1GsgILuLK/r+ZfeW4UBKtmDV5ivtLFW8UIOLWmOwQfg7fvff1K7qFRlto6 UWEs+h6uBk1Z/RNzPBNH0d99rY1651xIgKBP708UNePjexGtSVWuYtTsh/1RKzizS0Mf wyHrXsFdN/F+BcU3ByTBMhJm7nTR8Lne4hxM5ePCF/+CSpEY2wVSzoG9KTd1sQv0IlVp XBUKybCAdpMBZ2nRFh2H+EMKXUfnfYeXL0elE/NfbAs/VitLy0BuV8WBncQSq9qDZJYj DmKRDiRaBmgOJWHgNMv21svwTWFq4w6ubst69DepiJ3NI4iCmlX8UBBKjTcSVFMwB5iN i6uA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:mime-version:message-id:date:subject:cc:to:from; bh=mlgvq6wKhnYWqqodWZVHLbS8Bwfx+GLE9V0RKusxg2k=; b=Y38mGVxNzkBxi4RRRfxLa2Pb0/3NaBxFgXnla9J9TZ92/Rh1YNtVAHUTi2ybBUIHQQ FO6Q3OJdI2SfyyDXfx6EYu6TbGE/TAyR7niMdQ2m8x8x5WzS6TOsSIsQj0z/MUqL1hn1 m3YkZZGZ5dKFSkQvOEt8eHYBhfpTVcT5nE4wYOo7rMo/R6eTlpXpo35tTD0pS9aMB5Ly uxgwqRFqVPv1Wz0QOeBQWQ8E50GNPOkP7Y3b+jHWAoF3Z1ezNKg9HuaZPyT0s0/hMmRm rK3vKACAiggfFJHXPZOkUgnJlG+ZWjkqRCTYcALAva0ldMUZk6p4pwmCcaELurky2fcQ NfvQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id t62-20020a638141000000b00476daceffc3si9725237pgd.278.2022.12.03.01.55.12; Sat, 03 Dec 2022 01:55:26 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229566AbiLCJqo (ORCPT <rfc822;lhua1029@gmail.com> + 99 others); Sat, 3 Dec 2022 04:46:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56562 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229476AbiLCJqm (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Sat, 3 Dec 2022 04:46:42 -0500 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B54A562E87; Sat, 3 Dec 2022 01:46:40 -0800 (PST) Received: from canpemm500007.china.huawei.com (unknown [172.30.72.53]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4NPQ0y21WxzRp9g; Sat, 3 Dec 2022 17:45:54 +0800 (CST) Received: from localhost (10.174.179.215) by canpemm500007.china.huawei.com (7.192.104.62) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Sat, 3 Dec 2022 17:46:38 +0800 From: YueHaibing <yuehaibing@huawei.com> To: <jmaloy@redhat.com>, <ying.xue@windriver.com>, <davem@davemloft.net>, <edumazet@google.com>, <kuba@kernel.org>, <pabeni@redhat.com> CC: <netdev@vger.kernel.org>, <tipc-discussion@lists.sourceforge.net>, <linux-kernel@vger.kernel.org>, YueHaibing <yuehaibing@huawei.com> Subject: [PATCH net] tipc: Fix potential OOB in tipc_link_proto_rcv() Date: Sat, 3 Dec 2022 17:46:35 +0800 Message-ID: <20221203094635.29024-1-yuehaibing@huawei.com> X-Mailer: git-send-email 2.10.2.windows.1 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.174.179.215] X-ClientProxiedBy: dggems706-chm.china.huawei.com (10.3.19.183) To canpemm500007.china.huawei.com (7.192.104.62) X-CFilter-Loop: Reflected X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1751186225255272825?= X-GMAIL-MSGID: =?utf-8?q?1751186225255272825?= |
Series |
[net] tipc: Fix potential OOB in tipc_link_proto_rcv()
|
|
Commit Message
Yue Haibing
Dec. 3, 2022, 9:46 a.m. UTC
Fix the potential risk of OOB if skb_linearize() fails in
tipc_link_proto_rcv().
Fixes: 5cbb28a4bf65 ("tipc: linearize arriving NAME_DISTR and LINK_PROTO buffers")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
---
net/tipc/link.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
Comments
Hello: This patch was applied to netdev/net.git (master) by Paolo Abeni <pabeni@redhat.com>: On Sat, 3 Dec 2022 17:46:35 +0800 you wrote: > Fix the potential risk of OOB if skb_linearize() fails in > tipc_link_proto_rcv(). > > Fixes: 5cbb28a4bf65 ("tipc: linearize arriving NAME_DISTR and LINK_PROTO buffers") > Signed-off-by: YueHaibing <yuehaibing@huawei.com> > --- > net/tipc/link.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) Here is the summary with links: - [net] tipc: Fix potential OOB in tipc_link_proto_rcv() https://git.kernel.org/netdev/net/c/743117a997bb You are awesome, thank you!
diff --git a/net/tipc/link.c b/net/tipc/link.c index e260c0d557f5..b3ce24823f50 100644 --- a/net/tipc/link.c +++ b/net/tipc/link.c @@ -2224,7 +2224,9 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb, if (tipc_own_addr(l->net) > msg_prevnode(hdr)) l->net_plane = msg_net_plane(hdr); - skb_linearize(skb); + if (skb_linearize(skb)) + goto exit; + hdr = buf_msg(skb); data = msg_data(hdr);