releases/4.9.11/netlabel-out-of-bound-access-in-cipso_v4_validate.patch

   1 From foo@baz Tue Feb 14 17:03:08 PST 2017
   2 From: Eric Dumazet <edumazet@google.com>
   3 Date: Fri, 3 Feb 2017 00:03:26 -0800
   4 Subject: netlabel: out of bound access in cipso_v4_validate()
   5
   6 From: Eric Dumazet <edumazet@google.com>
   7
   8
   9 [ Upstream commit d71b7896886345c53ef1d84bda2bc758554f5d61 ]
  10
  11 syzkaller found another out of bound access in ip_options_compile(),
  12 or more exactly in cipso_v4_validate()
  13
  14 Fixes: 20e2a8648596 ("cipso: handle CIPSO options correctly when NetLabel is disabled")
  15 Fixes: 446fda4f2682 ("[NetLabel]: CIPSOv4 engine")
  16 Signed-off-by: Eric Dumazet <edumazet@google.com>
  17 Reported-by: Dmitry Vyukov  <dvyukov@google.com>
  18 Cc: Paul Moore <paul@paul-moore.com>
  19 Acked-by: Paul Moore <paul@paul-moore.com>
  20 Signed-off-by: David S. Miller <davem@davemloft.net>
  21 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  22 ---
  23  include/net/cipso_ipv4.h |    4 ++++
  24  net/ipv4/cipso_ipv4.c    |    4 ++++
  25  2 files changed, 8 insertions(+)
  26
  27 --- a/include/net/cipso_ipv4.h
  28 +++ b/include/net/cipso_ipv4.h
  29 @@ -309,6 +309,10 @@ static inline int cipso_v4_validate(cons
  30         }
  31
  32         for (opt_iter = 6; opt_iter < opt_len;) {
  33 +               if (opt_iter + 1 == opt_len) {
  34 +                       err_offset = opt_iter;
  35 +                       goto out;
  36 +               }
  37                 tag_len = opt[opt_iter + 1];
  38                 if ((tag_len == 0) || (tag_len > (opt_len - opt_iter))) {
  39                         err_offset = opt_iter + 1;
  40 --- a/net/ipv4/cipso_ipv4.c
  41 +++ b/net/ipv4/cipso_ipv4.c
  42 @@ -1587,6 +1587,10 @@ int cipso_v4_validate(const struct sk_bu
  43                                 goto validate_return_locked;
  44                         }
  45
  46 +               if (opt_iter + 1 == opt_len) {
  47 +                       err_offset = opt_iter;
  48 +                       goto validate_return_locked;
  49 +               }
  50                 tag_len = tag[1];
  51                 if (tag_len > (opt_len - opt_iter)) {
  52                         err_offset = opt_iter + 1;