Re: [PATCH net] tipc: check minimum bearer MTU

2016-12-01 Thread Ying Xue
For UDP bearer, it seems insufficient for us to check MTU size only when UDP bearer is enabled. Meanwhile, we should update MTU size for UDP bearer with Path MTU discovery protocol once MTU size is changed after bearer is enabled. I should admit I'm not that familiar with tipc. Do you mean upda

Re: [PATCH net] tipc: check minimum bearer MTU

2016-11-30 Thread kbuild test robot
Hi Michal, [auto build test ERROR on net/master] url: https://github.com/0day-ci/linux/commits/Michal-Kubecek/tipc-check-minimum-bearer-MTU/20161201-140555 config: i386-randconfig-s0-201648 (attached as .config) compiler: gcc-6 (Debian 6.2.0-3) 6.2.0 20160901 reproduce: # save the att

Re: [PATCH net] tipc: check minimum bearer MTU

2016-11-30 Thread Ben Hutchings
On Wed, 2016-11-30 at 11:24 +0100, Michal Kubecek wrote: > On Wed, Nov 30, 2016 at 10:57:02AM +0100, Michal Kubecek wrote: > > Qian Zhang (张谦) reported a potential socket buffer overflow in > > tipc_msg_build() which is also known as CVE-2016-8632: due to > > insufficient checks, a buffer overflow

Re: [PATCH net] tipc: check minimum bearer MTU

2016-11-30 Thread Michal Kubecek
On Wed, Nov 30, 2016 at 06:28:14PM +0800, Ying Xue wrote: ... > >diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h > >index 78892e2f53e3..1a0b7434ec24 100644 > >--- a/net/tipc/bearer.h > >+++ b/net/tipc/bearer.h > >@@ -39,6 +39,7 @@ > > > > #include "netlink.h" > > #include "core.h" > >+#include "

Re: [PATCH net] tipc: check minimum bearer MTU

2016-11-30 Thread Ying Xue
On 11/30/2016 05:57 PM, Michal Kubecek wrote: Qian Zhang (张谦) reported a potential socket buffer overflow in tipc_msg_build() which is also known as CVE-2016-8632: due to insufficient checks, a buffer overflow can occur if MTU is too short for even tipc headers. As anyone can set device MTU in a

Re: [PATCH net] tipc: check minimum bearer MTU

2016-11-30 Thread Michal Kubecek
On Wed, Nov 30, 2016 at 10:57:02AM +0100, Michal Kubecek wrote: > Qian Zhang (张谦) reported a potential socket buffer overflow in > tipc_msg_build() which is also known as CVE-2016-8632: due to > insufficient checks, a buffer overflow can occur if MTU is too short for > even tipc headers. As anyone

[PATCH net] tipc: check minimum bearer MTU

2016-11-30 Thread Michal Kubecek
Qian Zhang (张谦) reported a potential socket buffer overflow in tipc_msg_build() which is also known as CVE-2016-8632: due to insufficient checks, a buffer overflow can occur if MTU is too short for even tipc headers. As anyone can set device MTU in a user/net namespace, this issue can be abused by