RE: [PATCH] tipc: bound reassembly size in tipc_buf_append()

[Tung Quang Nguyen]

>Subject: [PATCH] tipc: bound reassembly size in tipc_buf_append()
>
>Hello,
>
>tipc_buf_append() accumulates fragments on the head skb without any
>cumulative size or fragment-count limit: head->len and head->truesize grow
>with every appended fragment, and the declared inner message size is only
>checked by tipc_msg_validate() once the LAST_FRAGMENT arrives.
>
>A peer that has established a TIPC link can send a FIRST_FRAGMENT followed
>by an unbounded stream of in-sequence FRAGMENT packets. Each fragment
>consumes a sequence number, so the link receive window slides and every
>packet passes the window check; nothing bounds the reassembly if the last
>fragment never arrives. The head skb's frag list therefore grows by roughly one
>bearer-MTU skb per attacker packet - a remote memory-exhaustion denial of
>service on any host with TIPC enabled and a bearer up.
>
 This cannot occur because protocol messages are guaranteed to be sent/received
(TIPC must be configured using IPsec or Encryption so that no crafted/corrupt messages are sent/received). 
Thus, LAST_FRAGMENT is always sent/received.

---
pw-bot: rejected