Re: [PATCH net RESEND] ieee802154: 6lowpan: validate fragment offset against datagram size

[Ryan Prinz <rc4d5a@protonmail.com>]

Thanks for the review! These are fair points, I'll respin.

- The accepted offset range has a closed upper bound (offset + length
  == d_size is allowed, as needed for the final fragment, including a
  zero-length one at offset == d_size), not the open [0, d_size) I
  described.
- 802.15.4 has no source authentication without llsec, so this bug
  doesn't let an attacker impersonate another sender as the message
  implied. The real effect is an attacker's fragment getting spliced
  into the reassembled datagram in place of a legitimate sender's
  bytes for a given span, via the overlap-eviction path you described.
- The CVE-2019-8359/Contiki-NG comparison doesn't match. That was an
  out-of-bounds write into a fixed buffer. This is a reassembly
  data-integrity issue only, since inet_frag_reasm_finish() links skbs
  by pointer rather than copying into a computed offset. Dropping that
  comparison.

Sending v2 with the commit message corrected; the fix itself is
unchanged.

pw-bot: cr