Re: [PATCH net] tipc: Guard against tiny MTU in tipc_msg_build()

2016-11-04 Thread 张谦
r.kernel.org [mailto:netdev-ow...@vger.kernel.org] >> On Behalf Of ?? >> Sent: Friday, 04 November, 2016 03:24 >> To: Jon Maloy ; Ben Hutchings >> ; Ying Xue >> Cc: netdev@vger.kernel.org; Eric Dumazet >> Subject: Re: [PATCH net] tipc: Guard against tiny MT

RE: [PATCH net] tipc: Guard against tiny MTU in tipc_msg_build()

2016-11-04 Thread Jon Maloy
2016年11月1日 19:37 > 收件人: 张谦; Ben Hutchings; Ying Xue > 抄送: netdev@vger.kernel.org; Eric Dumazet > 主题: RE: [PATCH net] tipc: Guard against tiny MTU in tipc_msg_build() > > Hi, > I think we all agreed in the end that this is a possible, but highly > implausible, > scenario, and

Re: [PATCH net] tipc: Guard against tiny MTU in tipc_msg_build()

2016-11-04 Thread 张谦
rk created. Thanks. Qian Zhang MarvelTeam Qihoo 360 -邮件原件- 发件人: Jon Maloy [mailto:jon.ma...@ericsson.com] 发送时间: 2016年11月1日 19:37 收件人: 张谦; Ben Hutchings; Ying Xue 抄送: netdev@vger.kernel.org; Eric Dumazet 主题: RE: [PATCH net] tipc: Guard against tiny MTU in tipc_msg_build() Hi, I think we

RE: [PATCH net] tipc: Guard against tiny MTU in tipc_msg_build()

2016-11-01 Thread Jon Maloy
contribute. BR ///jon > -Original Message- > From: 张谦 [mailto:zhangqia...@360.cn] > Sent: Tuesday, 01 November, 2016 02:35 > To: Ben Hutchings ; Jon Maloy > ; Ying Xue > Cc: netdev@vger.kernel.org; Eric Dumazet > Subject: Re: [PATCH net] tipc: Guard against tiny MTU in tip

Re: [PATCH net] tipc: Guard against tiny MTU in tipc_msg_build()

2016-10-21 Thread Ben Hutchings
ger.kernel.org; Qian Zhang ; Eric > > > > > > Dumazet > > > > > > Subject: Re: [PATCH net] tipc: Guard against tiny MTU in tipc_msg_build() > > > > On Thu, 2016-10-20 at 14:51 +, Jon Maloy wrote: > > [...] > > > > At this point

RE: [PATCH net] tipc: Guard against tiny MTU in tipc_msg_build()

2016-10-21 Thread Jon Maloy
> -Original Message- > From: Ben Hutchings [mailto:b...@decadent.org.uk] > Sent: Thursday, 20 October, 2016 12:40 > To: Jon Maloy ; Ying Xue > Cc: netdev@vger.kernel.org; Qian Zhang ; Eric Dumazet > > Subject: Re: [PATCH net] tipc: Guard against tiny MTU in tipc_ms

Re: [PATCH net] tipc: Guard against tiny MTU in tipc_msg_build()

2016-10-20 Thread Ben Hutchings
On Thu, 2016-10-20 at 14:51 +, Jon Maloy wrote: [...] > > At this point we're about to copy INT_H_SIZE + mhsz bytes into the > > first fragment.  If that's already limited to be less than or equal to > > MAX_H_SIZE, comparing with MAX_H_SIZE would be fine.  But if MAX_H_SIZE > > is the maximum

RE: [PATCH net] tipc: Guard against tiny MTU in tipc_msg_build()

2016-10-20 Thread Jon Maloy
> -Original Message- > From: Ben Hutchings [mailto:b...@decadent.org.uk] > Sent: Thursday, 20 October, 2016 08:46 > To: Ying Xue ; Jon Maloy > Cc: netdev@vger.kernel.org; Qian Zhang ; Eric Dumazet > > Subject: Re: [PATCH net] tipc: Guard against tiny MTU in tipc_ms

Re: [PATCH net] tipc: Guard against tiny MTU in tipc_msg_build()

2016-10-20 Thread Ben Hutchings
On Thu, 2016-10-20 at 17:30 +0800, Ying Xue wrote: > On 10/19/2016 10:16 AM, Ben Hutchings wrote: > > Qian Zhang (张谦) reported a potential socket buffer overflow in > > tipc_msg_build().  The minimum fragment length needs to be checked > > against the maximum packet size, which is based on the link

Re: [PATCH net] tipc: Guard against tiny MTU in tipc_msg_build()

2016-10-20 Thread Ying Xue
On 10/19/2016 10:16 AM, Ben Hutchings wrote: > Qian Zhang (张谦) reported a potential socket buffer overflow in > tipc_msg_build(). The minimum fragment length needs to be checked > against the maximum packet size, which is based on the link MTU. > > Reported-by: Qian Zhang (张谦) > Signed-off-by: B

[PATCH net] tipc: Guard against tiny MTU in tipc_msg_build()

2016-10-18 Thread Ben Hutchings
Qian Zhang (张谦) reported a potential socket buffer overflow in tipc_msg_build(). The minimum fragment length needs to be checked against the maximum packet size, which is based on the link MTU. Reported-by: Qian Zhang (张谦) Signed-off-by: Ben Hutchings --- This is untested, but I think it fixes