Skip to main content

Browse the archive

Revision 07718be265680dcf496347d475ce1a5442f55ad7 authored by Maxim Mikityanskiy on 10 June 2021, 16:40:30 UTC, committed by David S. Miller on 10 June 2021, 21:26:18 UTC 
mptcp: Fix out of bounds when parsing TCP options
 
The TCP option parser in mptcp (mptcp_get_options) could read one byte
out of bounds. When the length is 1, the execution flow gets into the
loop, reads one byte of the opcode, and if the opcode is neither
TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the
length of 1.

This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stack
out of bounds when parsing TCP options.").

Cc: Young Xiao <92siuyang@gmail.com>
Fixes: cec37a6e41aa ("mptcp: Handle MP_CAPABLE options for outgoing connections")
Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 5fc177a
Raw File
Makefile.kasan 
# SPDX-License-Identifier: GPL-2.0
CFLAGS_KASAN_NOSANITIZE := -fno-builtin
KASAN_SHADOW_OFFSET ?= $(CONFIG_KASAN_SHADOW_OFFSET)

cc-param = $(call cc-option, -mllvm -$(1), $(call cc-option, --param $(1)))

ifdef CONFIG_KASAN_STACK
	stack_enable := 1
else
	stack_enable := 0
endif

ifdef CONFIG_KASAN_GENERIC

ifdef CONFIG_KASAN_INLINE
	call_threshold := 10000
else
	call_threshold := 0
endif

CFLAGS_KASAN_MINIMAL := -fsanitize=kernel-address

# -fasan-shadow-offset fails without -fsanitize
CFLAGS_KASAN_SHADOW := $(call cc-option, -fsanitize=kernel-address \
			-fasan-shadow-offset=$(KASAN_SHADOW_OFFSET), \
			$(call cc-option, -fsanitize=kernel-address \
			-mllvm -asan-mapping-offset=$(KASAN_SHADOW_OFFSET)))

ifeq ($(strip $(CFLAGS_KASAN_SHADOW)),)
	CFLAGS_KASAN := $(CFLAGS_KASAN_MINIMAL)
else
	# Now add all the compiler specific options that are valid standalone
	CFLAGS_KASAN := $(CFLAGS_KASAN_SHADOW) \
	 $(call cc-param,asan-globals=1) \
	 $(call cc-param,asan-instrumentation-with-call-threshold=$(call_threshold)) \
	 $(call cc-param,asan-stack=$(stack_enable)) \
	 $(call cc-param,asan-instrument-allocas=1)
endif

endif # CONFIG_KASAN_GENERIC

ifdef CONFIG_KASAN_SW_TAGS

ifdef CONFIG_KASAN_INLINE
    instrumentation_flags := $(call cc-param,hwasan-mapping-offset=$(KASAN_SHADOW_OFFSET))
else
    instrumentation_flags := $(call cc-param,hwasan-instrument-with-calls=1)
endif

CFLAGS_KASAN := -fsanitize=kernel-hwaddress \
		$(call cc-param,hwasan-instrument-stack=$(stack_enable)) \
		$(call cc-param,hwasan-use-short-granules=0) \
		$(instrumentation_flags)

endif # CONFIG_KASAN_SW_TAGS

export CFLAGS_KASAN CFLAGS_KASAN_NOSANITIZE
back to top