|
 |
47585c |
From 59ede2cf4eee8729a4221000a5d1ecdd312a31ac Mon Sep 17 00:00:00 2001
|
|
|
47585c |
From: Lee Duncan <lduncan@suse.com>
|
|
|
47585c |
Date: Fri, 15 Dec 2017 11:21:15 -0800
|
|
|
47585c |
Subject: [PATCH] Check iscsiuio ping data length for validity
|
|
|
47585c |
|
|
|
47585c |
We do not trust that the received ping packet data length
|
|
|
47585c |
is correct, so sanity check it. Found by Qualsys.
|
|
|
47585c |
---
|
|
|
47585c |
iscsiuio/src/unix/iscsid_ipc.c | 5 +++++
|
|
|
47585c |
iscsiuio/src/unix/packet.c | 2 +-
|
|
|
47585c |
iscsiuio/src/unix/packet.h | 2 ++
|
|
|
47585c |
3 files changed, 8 insertions(+), 1 deletion(-)
|
|
|
47585c |
|
|
|
47585c |
diff --git a/iscsiuio/src/unix/iscsid_ipc.c b/iscsiuio/src/unix/iscsid_ipc.c
|
|
|
47585c |
index 4e3d065667c9..d4322350fcf6 100644
|
|
|
47585c |
--- a/iscsiuio/src/unix/iscsid_ipc.c
|
|
|
47585c |
+++ b/iscsiuio/src/unix/iscsid_ipc.c
|
|
|
47585c |
@@ -328,6 +328,11 @@ static void *perform_ping(void *arg)
|
|
|
47585c |
|
|
|
47585c |
data = (iscsid_uip_broadcast_t *)png_c->data;
|
|
|
47585c |
datalen = data->u.ping_rec.datalen;
|
|
|
47585c |
+ if ((datalen > STD_MTU_SIZE) || (datalen < 0)) {
|
|
|
47585c |
+ LOG_ERR(PFX "Ping datalen invalid: %d", datalen);
|
|
|
47585c |
+ rc = -EINVAL;
|
|
|
47585c |
+ goto ping_done;
|
|
|
47585c |
+ }
|
|
|
47585c |
|
|
|
47585c |
memset(dst_addr, 0, sizeof(uip_ip6addr_t));
|
|
|
47585c |
if (nic_iface->protocol == AF_INET) {
|
|
|
47585c |
diff --git a/iscsiuio/src/unix/packet.c b/iscsiuio/src/unix/packet.c
|
|
|
47585c |
index ecea09bedc22..3ce2c6b623e0 100644
|
|
|
47585c |
--- a/iscsiuio/src/unix/packet.c
|
|
|
47585c |
+++ b/iscsiuio/src/unix/packet.c
|
|
|
47585c |
@@ -112,7 +112,7 @@ int alloc_free_queue(nic_t *nic, size_t num_of_packets)
|
|
|
47585c |
for (i = 0; i < num_of_packets; i++) {
|
|
|
47585c |
packet_t *pkt;
|
|
|
47585c |
|
|
|
47585c |
- pkt = alloc_packet(1500, 1500);
|
|
|
47585c |
+ pkt = alloc_packet(STD_MTU_SIZE, STD_MTU_SIZE);
|
|
|
47585c |
if (pkt == NULL) {
|
|
|
47585c |
goto done;
|
|
|
47585c |
}
|
|
|
47585c |
diff --git a/iscsiuio/src/unix/packet.h b/iscsiuio/src/unix/packet.h
|
|
|
47585c |
index b63d68851bb4..19d1db912d18 100644
|
|
|
47585c |
--- a/iscsiuio/src/unix/packet.h
|
|
|
47585c |
+++ b/iscsiuio/src/unix/packet.h
|
|
|
47585c |
@@ -43,6 +43,8 @@
|
|
|
47585c |
|
|
|
47585c |
#include "nic.h"
|
|
|
47585c |
|
|
|
47585c |
+#define STD_MTU_SIZE 1500
|
|
|
47585c |
+
|
|
|
47585c |
struct nic;
|
|
|
47585c |
struct nic_interface;
|
|
|
47585c |
|
|
|
47585c |
--
|
|
|
47585c |
2.17.2
|
|
|
47585c |
|