Skip to contentSkip to conversation

igmp: Avoid zero delay when receiving odd mixture of IGMP queries

PATCH In review Ben Hutchings 2 participants 3 messages Jan 9, 2012 – Jan 10, 2012

Subsystems (3)
Networking Network drivers IPv4/IPv6
lore
Share & tools
lore

Ben Hutchings

author
#0 lore raw

PATCH 1/1 igmp: Avoid zero delay when receiving odd mixture of IGMP queries

Commit 5b7c84066733c5dfb0e4016d939757b38de189e4 ('ipv4: correct IGMP behavior on v3 query during v2-compatibility mode') added yet another case for query parsing, which can result in max_delay = 0. Substitute a value of 1, as in the usual v3 case.

Reported-by Simon McVittie <[email protected]>

References: http://bugs.debian.org/654876

Signed-off-by Ben Hutchings <[email protected]>
---
 net/ipv4/igmp.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
net/ipv4/igmp.c +2 -0
index d577199..e0d42db 100644
@@ -875,6 +875,8 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
 		 * to be intended in a v3 query.
 		 */
 		max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
+		if (!max_delay)
+			max_delay = 1;	/* can't mod w/ 0 */
 	} else { /* v3 */
 		if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
 			return;
Signature · 1 line
1.7.8.2
maintainer
#1 lore raw

From: Ben Hutchings <[email protected]>
Date: Mon, 9 Jan 2012 22:04:28 +0000

Quoted 8 lines

Commit 5b7c84066733c5dfb0e4016d939757b38de189e4 ('ipv4: correct IGMP behavior on v3 query during v2-compatibility mode') added yet another case for query parsing, which can result in max_delay = 0. Substitute a value of 1, as in the usual v3 case.

Reported-by Simon McVittie <[email protected]>

References: http://bugs.debian.org/654876

Signed-off-by Ben Hutchings <[email protected]>

Applied and queued up for -stable, thanks Ben.

author
#2 lore raw
In reply to Ben Hutchings
Quoted 4 lines · Ben Hutchings

Commit 5b7c84066733c5dfb0e4016d939757b38de189e4 ('ipv4: correct IGMP behavior on v3 query during v2-compatibility mode') added yet another case for query parsing, which can result in max_delay = 0. Substitute a value of 1, as in the usual v3 case.

This has been assigned CVE-2012-0207.

Ben.

Quoted 20 lines
Reported-by Simon McVittie <[email protected]>

References: http://bugs.debian.org/654876

Signed-off-by Ben Hutchings <[email protected]>
---
 net/ipv4/igmp.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
net/ipv4/igmp.c +2 -0
index d577199..e0d42db 100644
@@ -875,6 +875,8 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
 		 * to be intended in a v3 query.
 		 */
 		max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
+		if (!max_delay)
+			max_delay = 1;	/* can't mod w/ 0 */
 	} else { /* v3 */
 		if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
 			return;
Signature · 3 lines
Ben Hutchings
Life is what happens to you while you're busy making other plans.
                                                               - John Lennon