[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <17753.1467131509@turing-police.cc.vt.edu>
Date: Tue, 28 Jun 2016 12:31:49 -0400
From: Valdis.Kletnieks@...edu
To: kernel-hardening@...ts.openwall.com
Subject: Re: Usercopy caught another one - ping IPv6...
On Tue, 28 Jun 2016 15:15:25 +0200, Marcus Meissner said:
> Hi,
>
> This is probably the ICMPV6_FILTER setting?
>
> if (optlen > sizeof(struct icmp6_filter))
> optlen = sizeof(struct icmp6_filter);
> if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
> return -EFAULT;
>
> struct raw6_sock has
> struct icmp6_filter filter;
>
> not sure where the bug is.
Probably no actual bug, but the allocation of storage for 'filter' needs to be
annotated. Thanks for finding that, that's the *hard* part. I'll look at it
and see if a reasonable patch is doable...
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
