From: yujuan.qi <yujuan.qi@mediatek.com>
Date: Mon, 31 Jul 2017 03:23:01 +0000 (+0800)
Subject: Cipso: cipso_v4_optptr enter infinite loop
X-Git-Tag: v4.1.12-124.31.3~554
X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=276f0d55552706a4a22a244f4bde02e5c693be1c;p=users%2Fjedix%2Flinux-maple.git

Cipso: cipso_v4_optptr enter infinite loop

Orabug: 28563992
CVE: CVE-2018-10938

in for(),if((optlen > 0) && (optptr[1] == 0)), enter infinite loop.

Test: receive a packet which the ip length > 20 and the first byte of ip option is 0, produce this issue

Signed-off-by: yujuan.qi <yujuan.qi@mediatek.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 40413955ee265a5e42f710940ec78f5450d49149)
Signed-off-by: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com>
Reviewed-by: Brian Maly <brian.maly@oracle.com
Signed-off-by: Brian Maly <brian.maly@oracle.com>
---

diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index bdb2a07ec363..b77502018e26 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1593,9 +1593,17 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
 	int taglen;
 
 	for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
-		if (optptr[0] == IPOPT_CIPSO)
+		switch (optptr[0]) {
+		case IPOPT_CIPSO:
 			return optptr;
-		taglen = optptr[1];
+		case IPOPT_END:
+			return NULL;
+		case IPOPT_NOOP:
+			taglen = 1;
+			break;
+		default:
+			taglen = optptr[1];
+		}
 		optlen -= taglen;
 		optptr += taglen;
 	}