From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752384AbcLESgP (ORCPT ); Mon, 5 Dec 2016 13:36:15 -0500 Received: from shards.monkeyblade.net ([184.105.139.130]:47710 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752111AbcLESgO (ORCPT ); Mon, 5 Dec 2016 13:36:14 -0500 Date: Mon, 05 Dec 2016 13:36:11 -0500 (EST) Message-Id: <20161205.133611.650439526320620182.davem@davemloft.net> To: keescook@chromium.org Cc: netdev@vger.kernel.org, mchong@google.com, i@flanker017.me, kuznet@ms2.inr.ac.ru, jmorris@namei.org, yoshfuji@linux-ipv6.org, kaber@trash.net, linux-kernel@vger.kernel.org Subject: Re: [PATCH v2] net: ping: check minimum size on ICMP header length From: David Miller In-Reply-To: <20161205183438.GA133528@beast> References: <20161205183438.GA133528@beast> X-Mailer: Mew version 6.7 on Emacs 24.5 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Mon, 05 Dec 2016 09:36:51 -0800 (PST) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Kees Cook Date: Mon, 5 Dec 2016 10:34:38 -0800 > Prior to commit c0371da6047a ("put iov_iter into msghdr") in v3.19, there > was no check that the iovec contained enough bytes for an ICMP header, > and the read loop would walk across neighboring stack contents. Since the > iov_iter conversion, bad arguments are noticed, but the returned error is > EFAULT. Returning EINVAL is a clearer error and also solves the problem > prior to v3.19. > > This was found using trinity with KASAN on v3.18: ... > CVE-2016-8399 > > Reported-by: Qidan He > Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind") > Cc: stable@vger.kernel.org > Signed-off-by: Kees Cook Applied and queued up for -stable, thanks.