af_key: Fix for sadb_key memcpy read overrun
Status from this message: Applied to the ipsec tree, thanks Kevin!
Get series with b4
b4 am [email protected]Versions newest first · linked by author and title
- v2 Latest2 patches 4 repliesApplied
- v12 patches 3 repliesSuperseded
Patches in v2 Applied
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/2 | af_key: Always verify length of provided sadb_keynet/ | +35 | 1 reply | |
| 2/2 | af_key: Use DIV_ROUND_UP() instead of open-coded equivalentnet/ | +7 | 2 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v2 yet.
Cover letter [PATCH v2 0/2] af_key: Fix for sadb_key memcpy read overrun
As found by syzbot, af_key does not properly validate the key length in sadb_key messages from userspace. This can result in copying from beyond the end of the sadb_key part of the message, or indeed beyond the end of the entire packet.
Both these patches apply cleanly to ipsec-next. Based on Steffen's feedback I have re-ordered them so that the fix only is in patch 1, which I would suggest is also a stable tree candidate, whereas patch 2 is a cleanup only.
Kevin Easton (2):
af_key: Always verify length of provided sadb_key
af_key: Use DIV_ROUND_UP() instead of open-coded equivalent
net/key/af_key.c | 58 ++++++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 42 insertions(+), 16 deletions(-)
Signature · 1 line
2.8.1