subject:"\[PATCH net 2\/2\] dccp\: limit sk_filter trim to payload"

Re: [PATCH net 2/2] dccp: limit sk_filter trim to payload

2016-07-12 Thread Daniel Borkmann

On 07/13/2016 12:18 AM, Willem de Bruijn wrote: From: Willem de Bruijn Dccp verifies packet integrity, including length, at initial rcv in dccp_invalid_packet, later pulls headers in dccp_enqueue_skb. A call to sk_filter in-between can cause __skb_pull to wrap skb->len. skb_copy_datagram_msg i

[PATCH net 2/2] dccp: limit sk_filter trim to payload

2016-07-12 Thread Willem de Bruijn

From: Willem de Bruijn Dccp verifies packet integrity, including length, at initial rcv in dccp_invalid_packet, later pulls headers in dccp_enqueue_skb. A call to sk_filter in-between can cause __skb_pull to wrap skb->len. skb_copy_datagram_msg interprets this as a negative value, so (correctly)