Revision 924a9bc362a5223cd448ca08c3dde21235adc310 authored by Balazs Nemeth on 09 March 2021, 11:31:00 UTC, committed by David S. Miller on 10 March 2021, 00:12:20 UTC
For gso packets, virtio_net_hdr_set_proto sets the protocol (if it isn't set) based on the type in the virtio net hdr, but the skb could contain anything since it could come from packet_snd through a raw socket. If there is a mismatch between what virtio_net_hdr_set_proto sets and the actual protocol, then the skb could be handled incorrectly later on. An example where this poses an issue is with the subsequent call to skb_flow_dissect_flow_keys_basic which relies on skb->protocol being set correctly. A specially crafted packet could fool skb_flow_dissect_flow_keys_basic preventing EINVAL to be returned. Avoid blindly trusting the information provided by the virtio net header by checking that the protocol in the packet actually matches the protocol set by virtio_net_hdr_set_proto. Note that since the protocol is only checked if skb->dev implements header_ops->parse_protocol, packets from devices without the implementation are not checked at this stage. Fixes: 9274124f023b ("net: stricter validation of untrusted gso packets") Signed-off-by: Balazs Nemeth <bnemeth@redhat.com> Acked-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 286a862
File | Mode | Size |
---|---|---|
Kconfig | -rw-r--r-- | 27.7 KB |
Makefile | -rw-r--r-- | 3.7 KB |
aec62xx.c | -rw-r--r-- | 9.2 KB |
ali14xx.c | -rw-r--r-- | 6.5 KB |
alim15x3.c | -rw-r--r-- | 14.9 KB |
amd74xx.c | -rw-r--r-- | 9.9 KB |
atiixp.c | -rw-r--r-- | 5.6 KB |
buddha.c | -rw-r--r-- | 5.6 KB |
cmd640.c | -rw-r--r-- | 22.5 KB |
cmd64x.c | -rw-r--r-- | 12.1 KB |
cs5520.c | -rw-r--r-- | 4.7 KB |
cs5530.c | -rw-r--r-- | 8.1 KB |
cs5535.c | -rw-r--r-- | 6.0 KB |
cs5536.c | -rw-r--r-- | 7.0 KB |
cy82c693.c | -rw-r--r-- | 6.3 KB |
delkin_cb.c | -rw-r--r-- | 4.4 KB |
dtc2278.c | -rw-r--r-- | 3.8 KB |
falconide.c | -rw-r--r-- | 4.4 KB |
gayle.c | -rw-r--r-- | 4.4 KB |
hpt366.c | -rw-r--r-- | 41.9 KB |
ht6560b.c | -rw-r--r-- | 10.5 KB |
icside.c | -rw-r--r-- | 16.3 KB |
ide-4drives.c | -rw-r--r-- | 1.5 KB |
ide-acpi.c | -rw-r--r-- | 16.5 KB |
ide-atapi.c | -rw-r--r-- | 18.5 KB |
ide-cd.c | -rw-r--r-- | 47.0 KB |
ide-cd.h | -rw-r--r-- | 3.4 KB |
ide-cd_ioctl.c | -rw-r--r-- | 11.3 KB |
ide-cd_verbose.c | -rw-r--r-- | 13.6 KB |
ide-cs.c | -rw-r--r-- | 12.0 KB |
ide-devsets.c | -rw-r--r-- | 3.9 KB |
ide-disk.c | -rw-r--r-- | 19.3 KB |
ide-disk.h | -rw-r--r-- | 705 bytes |
ide-disk_ioctl.c | -rw-r--r-- | 993 bytes |
ide-disk_proc.c | -rw-r--r-- | 3.3 KB |
ide-dma-sff.c | -rw-r--r-- | 8.9 KB |
ide-dma.c | -rw-r--r-- | 13.2 KB |
ide-eh.c | -rw-r--r-- | 12.4 KB |
ide-floppy.c | -rw-r--r-- | 14.6 KB |
ide-floppy.h | -rw-r--r-- | 1.2 KB |
ide-floppy_ioctl.c | -rw-r--r-- | 8.1 KB |
ide-floppy_proc.c | -rw-r--r-- | 916 bytes |
ide-gd.c | -rw-r--r-- | 10.4 KB |
ide-gd.h | -rw-r--r-- | 971 bytes |
ide-generic.c | -rw-r--r-- | 3.5 KB |
ide-io-std.c | -rw-r--r-- | 6.4 KB |
ide-io.c | -rw-r--r-- | 24.0 KB |
ide-ioctls.c | -rw-r--r-- | 7.1 KB |
ide-iops.c | -rw-r--r-- | 13.7 KB |
ide-legacy.c | -rw-r--r-- | 1.3 KB |
ide-lib.c | -rw-r--r-- | 3.8 KB |
ide-park.c | -rw-r--r-- | 3.7 KB |
ide-pci-generic.c | -rw-r--r-- | 6.0 KB |
ide-pio-blacklist.c | -rw-r--r-- | 2.3 KB |
ide-pm.c | -rw-r--r-- | 6.8 KB |
ide-pnp.c | -rw-r--r-- | 2.1 KB |
ide-probe.c | -rw-r--r-- | 37.9 KB |
ide-proc.c | -rw-r--r-- | 15.4 KB |
ide-scan-pci.c | -rw-r--r-- | 2.7 KB |
ide-sysfs.c | -rw-r--r-- | 3.2 KB |
ide-tape.c | -rw-r--r-- | 55.5 KB |
ide-taskfile.c | -rw-r--r-- | 16.5 KB |
ide-timings.c | -rw-r--r-- | 5.8 KB |
ide-xfer-mode.c | -rw-r--r-- | 6.7 KB |
ide.c | -rw-r--r-- | 10.5 KB |
ide_platform.c | -rw-r--r-- | 3.0 KB |
it8172.c | -rw-r--r-- | 5.1 KB |
it8213.c | -rw-r--r-- | 5.6 KB |
it821x.c | -rw-r--r-- | 20.4 KB |
jmicron.c | -rw-r--r-- | 4.5 KB |
macide.c | -rw-r--r-- | 3.5 KB |
ns87415.c | -rw-r--r-- | 9.0 KB |
opti621.c | -rw-r--r-- | 4.5 KB |
palm_bk3710.c | -rw-r--r-- | 10.0 KB |
pdc202xx_new.c | -rw-r--r-- | 14.2 KB |
pdc202xx_old.c | -rw-r--r-- | 10.1 KB |
piix.c | -rw-r--r-- | 14.0 KB |
pmac.c | -rw-r--r-- | 45.1 KB |
q40ide.c | -rw-r--r-- | 4.1 KB |
qd65xx.c | -rw-r--r-- | 10.9 KB |
qd65xx.h | -rw-r--r-- | 5.8 KB |
rapide.c | -rw-r--r-- | 2.0 KB |
rz1000.c | -rw-r--r-- | 2.3 KB |
sc1200.c | -rw-r--r-- | 9.2 KB |
serverworks.c | -rw-r--r-- | 12.7 KB |
setup-pci.c | -rw-r--r-- | 17.0 KB |
siimage.c | -rw-r--r-- | 20.9 KB |
sis5513.c | -rw-r--r-- | 18.1 KB |
sl82c105.c | -rw-r--r-- | 9.5 KB |
slc90e66.c | -rw-r--r-- | 4.9 KB |
tc86c001.c | -rw-r--r-- | 7.5 KB |
triflex.c | -rw-r--r-- | 3.2 KB |
trm290.c | -rw-r--r-- | 10.8 KB |
tx4938ide.c | -rw-r--r-- | 5.5 KB |
tx4939ide.c | -rw-r--r-- | 17.0 KB |
umc8672.c | -rw-r--r-- | 5.0 KB |
via82cxxx.c | -rw-r--r-- | 14.5 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...