Commit 5923dec9 authored by David Howells's avatar David Howells Committed by Yi Yang
Browse files

keys, dns: Fix size check of V1 server-list header 

stable inclusion
from stable-v5.10.209
commit 4533e7623e6d206a6d8e67c9f8d242dd022accbb
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9TM8D
CVE: CVE-2024-36031

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4533e7623e6d206a6d8e67c9f8d242dd022accbb



--------------------------------

commit acc657692aed438e9931438f8c923b2b107aebf9 upstream.

Fix the size check added to dns_resolver_preparse() for the V1 server-list
header so that it doesn't give EINVAL if the size supplied is the same as
the size of the header struct (which should be valid).

This can be tested with:

        echo -n -e '\0\0\01\xff\0\0' | keyctl padd dns_resolver desc @p

which will give "add_key: Invalid argument" without this fix.

Fixes: 1997b3cb4217 ("keys, dns: Fix missing size check of V1 server-list header")
Reported-by: default avatarPengfei Xu <pengfei.xu@intel.com>
Link: https://lore.kernel.org/r/ZZ4fyY4r3rqgZL+4@xpf.sh.intel.com/


Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Cc: Petr Vorel <pvorel@suse.cz>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarYi Yang <yiyang13@huawei.com>
parent d8507377

net/dns_resolver/dns_key.c

+1 −1
Original line number Diff line number Diff line
@@ -104,7 +104,7 @@ dns_resolver_preparse(struct key_preparsed_payload *prep) 
		const struct dns_server_list_v1_header *v1;



		/* It may be a server list. */

		if (datalen <= sizeof(*v1))

		if (datalen < sizeof(*v1))

			return -EINVAL;



		v1 = (const struct dns_server_list_v1_header *)data;