Skip to content

Commit f2e5ddc

Browse files
Seif Mazareebdavem330
Seif Mazareeb
authored andcommitted
net: fix cipso packet validation when !NETLABEL
When CONFIG_NETLABEL is disabled, the cipso_v4_validate() function could loop forever in the main loop if opt[opt_iter +1] == 0, this will causing a kernel crash in an SMP system, since the CPU executing this function will stall /not respond to IPIs. This problem can be reproduced by running the IP Stack Integrity Checker (http://isic.sourceforge.net) using the following command on a Linux machine connected to DUT: "icmpsic -s rand -d <DUT IP address> -r 123456" wait (1-2 min) Signed-off-by: Seif Mazareeb <seif@marvell.com> Acked-by: Paul Moore <paul@paul-moore.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 90c6bd3 commit f2e5ddc

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

Diff for: include/net/cipso_ipv4.h

+4-2
Original file line numberDiff line numberDiff line change
@@ -290,6 +290,7 @@ static inline int cipso_v4_validate(const struct sk_buff *skb,
290290
unsigned char err_offset = 0;
291291
u8 opt_len = opt[1];
292292
u8 opt_iter;
293+
u8 tag_len;
293294

294295
if (opt_len < 8) {
295296
err_offset = 1;
@@ -302,11 +303,12 @@ static inline int cipso_v4_validate(const struct sk_buff *skb,
302303
}
303304

304305
for (opt_iter = 6; opt_iter < opt_len;) {
305-
if (opt[opt_iter + 1] > (opt_len - opt_iter)) {
306+
tag_len = opt[opt_iter + 1];
307+
if ((tag_len == 0) || (opt[opt_iter + 1] > (opt_len - opt_iter))) {
306308
err_offset = opt_iter + 1;
307309
goto out;
308310
}
309-
opt_iter += opt[opt_iter + 1];
311+
opt_iter += tag_len;
310312
}
311313

312314
out:

0 commit comments

Comments
 (0)