Patch "dccp: fix out of bound access in dccp_v4_err()" has been added to the 4.8-stable tree

This is a note to let you know that I've just added the patch titled

dccp: fix out of bound access in dccp_v4_err()

to the 4.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
dccp-fix-out-of-bound-access-in-dccp_v4_err.patch
and it can be found in the queue-4.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Eric Dumazet <[email protected]>
Date: Wed, 2 Nov 2016 19:00:40 -0700
Subject: dccp: fix out of bound access in dccp_v4_err()

From: Eric Dumazet <[email protected]>

[ Upstream commit 6706a97fec963d6cb3f7fc2978ec1427b4651214 ]

dccp_v4_err() does not use pskb_may_pull() and might access garbage.

We only need 4 bytes at the beginning of the DCCP header, like TCP, so the 8 bytes pulled in icmp_socket_deliver() are more than enough.

This patch might allow to process more ICMP messages, as some routers are still limiting the size of reflected bytes to 28 (RFC 792), instead of extended lengths (RFC 1812 4.3.2.3)

---
 net/dccp/ipv4.c |   14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

@@ -235,7 +235,7 @@ static void dccp_v4_err(struct sk_buff *
 {
 	const struct iphdr *iph = (struct iphdr *)skb->data;
 	const u8 offset = iph->ihl << 2;
-	const struct dccp_hdr *dh = (struct dccp_hdr *)(skb->data + offset);
+	const struct dccp_hdr *dh;
 	struct dccp_sock *dp;
 	struct inet_sock *inet;
 	const int type = icmp_hdr(skb)->type;

@@ -245,11 +245,13 @@ static void dccp_v4_err(struct sk_buff *
 	int err;
 	struct net *net = dev_net(skb->dev);
 
-	if (skb->len < offset + sizeof(*dh) ||
-	    skb->len < offset + __dccp_basic_hdr_len(dh)) {
-		__ICMP_INC_STATS(net, ICMP_MIB_INERRORS);
-		return;
-	}
+	/* Only need dccph_dport & dccph_sport which are the first
+	 * 4 bytes in dccp header.
+	 * Our caller (icmp_socket_deliver()) already pulled 8 bytes for us.
+	 */
+	BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_sport) > 8);
+	BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8);
+	dh = (struct dccp_hdr *)(skb->data + offset);
 
 	sk = __inet_lookup_established(net, &dccp_hashinfo,
 				       iph->daddr, dh->dccph_dport,

Patches currently in stable-queue which might be from [email protected] are

queue-4.8/net-__skb_flow_dissect-must-cap-its-return-value.patch queue-4.8/tcp-take-care-of-truncations-done-by-sk_filter.patch queue-4.8/net-clear-sk_err_soft-in-sk_clone_lock.patch queue-4.8/dccp-do-not-release-listeners-too-soon.patch queue-4.8/net-mangle-zero-checksum-in-skb_checksum_help.patch queue-4.8/tcp-fix-return-value-for-partial-writes.patch queue-4.8/ipv6-dccp-fix-out-of-bound-access-in-dccp_v6_err.patch queue-4.8/ipv6-dccp-add-missing-bind_conflict-to-dccp_ipv6_mapped.patch queue-4.8/tcp-fix-potential-memory-corruption.patch queue-4.8/dccp-do-not-send-reset-to-already-closed-sockets.patch queue-4.8/dccp-fix-out-of-bound-access-in-dccp_v4_err.patch queue-4.8/sock-fix-sendmmsg-for-partial-sendmsg.patch