Re: [PATCH net] xfrm: Rewrite key length conversion to avoid overflows

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

To: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Subject: Re: [PATCH net] xfrm: Rewrite key length conversion to avoid overflows
From: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Date: Wed, 18 Dec 2024 19:58:59 +0800
Cc: Justin Stitt <justinstitt@xxxxxxxxxx>, Kees Cook <kees@xxxxxxxxxx>, Steffen Klassert <steffen.klassert@xxxxxxxxxxx>, "David S. Miller" <davem@xxxxxxxxxxxxx>, Eric Dumazet <edumazet@xxxxxxxxxx>, Jakub Kicinski <kuba@xxxxxxxxxx>, Paolo Abeni <pabeni@xxxxxxxxxx>, Simon Horman <horms@xxxxxxxxxx>, netdev@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, kernel-janitors@xxxxxxxxxxxxxxx, linux-hardening@xxxxxxxxxxxxxxx
In-reply-to: <cedbaec9-d149-48af-8068-182f0af5a89c@stanley.mountain>
References: <92dc4619-7598-439e-8544-4b3b2cf5e597@stanley.mountain> <Z2FompbNt6NBEoln@gondor.apana.org.au> <053456e5-56e7-478b-b73e-96b7c2098d07@stanley.mountain> <Z2KZC71JZ0QnrhfU@gondor.apana.org.au> <cedbaec9-d149-48af-8068-182f0af5a89c@stanley.mountain>

On Wed, Dec 18, 2024 at 01:54:38PM +0300, Dan Carpenter wrote:
>
> The length is capped in verify_one_alg() type functions:
> 
> 	if (nla_len(rt) < (int)xfrm_alg_len(algp)) {
> 
> nla_len() is a USHRT_MAX so the rounded value can't be higher than that.

Good catch.  I hope a similar limit applies for af_key?

Thanks,
-- 
Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

References:
- [PATCH net] xfrm: prevent some integer overflows in verify_ functions
  - From: Dan Carpenter
- Re: [PATCH net] xfrm: prevent some integer overflows in verify_ functions
  - From: Herbert Xu
- Re: [PATCH net] xfrm: prevent some integer overflows in verify_ functions
  - From: Dan Carpenter
- [PATCH net] xfrm: Rewrite key length conversion to avoid overflows
  - From: Herbert Xu
- Re: [PATCH net] xfrm: Rewrite key length conversion to avoid overflows
  - From: Dan Carpenter

Prev by Date: Re: [PATCH net] xfrm: Rewrite key length conversion to avoid overflows
Next by Date: Re: [PATCH net v2 1/2] octeontx2-pf: fix netdev memory leak in rvu_rep_create()
Previous by thread: Re: [PATCH net] xfrm: Rewrite key length conversion to avoid overflows
Next by thread: [PATCH][next] wifi: ath12k: Fix spelling mistake "requestted" -> "requested"
Index(es):
- Date
- Thread

[Index of Archives] [Kernel Development] [Kernel Announce] [Kernel Newbies] [Linux Networking Development] [Share Photos] [IDE] [Security] [Git] [Netfilter] [Yosemite News] [MIPS Linux] [ARM Linux] [Device Mapper]