lkml.org 
[lkml]   [2005]   [Dec]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 07/26] [NETLINK]: Fix processing of fib_lookup netlink messages
    -stable review patch.  If anyone has any objections, please let us know.

    ------------------
    From: Thomas Graf <tgraf@suug.ch>

    The receive path for fib_lookup netlink messages is lacking sanity
    checks for header and payload and is thus vulnerable to malformed
    netlink messages causing illegal memory references.

    Signed-off-by: Thomas Graf <tgraf@suug.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    net/ipv4/fib_frontend.c | 8 ++++++--
    1 file changed, 6 insertions(+), 2 deletions(-)

    --- linux-2.6.14.3.orig/net/ipv4/fib_frontend.c
    +++ linux-2.6.14.3/net/ipv4/fib_frontend.c
    @@ -545,12 +545,16 @@ static void nl_fib_input(struct sock *sk
    struct sk_buff *skb = NULL;
    struct nlmsghdr *nlh = NULL;
    struct fib_result_nl *frn;
    - int err;
    u32 pid;
    struct fib_table *tb;

    - skb = skb_recv_datagram(sk, 0, 0, &err);
    + skb = skb_dequeue(&sk->sk_receive_queue);
    nlh = (struct nlmsghdr *)skb->data;
    + if (skb->len < NLMSG_SPACE(0) || skb->len < nlh->nlmsg_len ||
    + nlh->nlmsg_len < NLMSG_LENGTH(sizeof(*frn))) {
    + kfree_skb(skb);
    + return;
    + }

    frn = (struct fib_result_nl *) NLMSG_DATA(nlh);
    tb = fib_get_table(frn->tb_id_in);
    --
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-12-13 09:29    [W:0.022 / U:29.536 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site