| From stable-bounces@linux.kernel.org Thu Dec 1 14:08:28 2005 |
| Date: Thu, 1 Dec 2005 23:05:12 +0100 |
| From: Thomas Graf <tgraf@suug.ch> |
| To: "David S. Miller" <davem@davemloft.net> |
| Message-ID: <20051201220512.GT20395@postel.suug.ch> |
| Cc: Robert Olsson <Robert.Olsson@data.slu.se>, stable@kernel.org, netdev@vger.kernel.org |
| Subject: NETLINK: Fix processing of fib_lookup netlink messages |
| |
| The receive path for fib_lookup netlink messages is lacking sanity |
| checks for header and payload and is thus vulnerable to malformed |
| netlink messages causing illegal memory references. |
| |
| Signed-off-by: Thomas Graf <tgraf@suug.ch> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| net/ipv4/fib_frontend.c | 8 ++++++-- |
| 1 file changed, 6 insertions(+), 2 deletions(-) |
| |
| --- linux-2.6.14.3.orig/net/ipv4/fib_frontend.c |
| +++ linux-2.6.14.3/net/ipv4/fib_frontend.c |
| @@ -545,12 +545,16 @@ static void nl_fib_input(struct sock *sk |
| struct sk_buff *skb = NULL; |
| struct nlmsghdr *nlh = NULL; |
| struct fib_result_nl *frn; |
| - int err; |
| u32 pid; |
| struct fib_table *tb; |
| |
| - skb = skb_recv_datagram(sk, 0, 0, &err); |
| + skb = skb_dequeue(&sk->sk_receive_queue); |
| nlh = (struct nlmsghdr *)skb->data; |
| + if (skb->len < NLMSG_SPACE(0) || skb->len < nlh->nlmsg_len || |
| + nlh->nlmsg_len < NLMSG_LENGTH(sizeof(*frn))) { |
| + kfree_skb(skb); |
| + return; |
| + } |
| |
| frn = (struct fib_result_nl *) NLMSG_DATA(nlh); |
| tb = fib_get_table(frn->tb_id_in); |
