* [PATCH] netlink: validate NLA_MSECS length
@ 2011-11-03 10:07 Johannes Berg
2011-11-04 21:48 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Johannes Berg @ 2011-11-03 10:07 UTC (permalink / raw)
To: netdev; +Cc: Thomas Graf
From: Johannes Berg <johannes.berg@intel.com>
L2TP for example uses NLA_MSECS like this:
policy:
[L2TP_ATTR_RECV_TIMEOUT] = { .type = NLA_MSECS, },
code:
if (info->attrs[L2TP_ATTR_RECV_TIMEOUT])
cfg.reorder_timeout = nla_get_msecs(info->attrs[L2TP_ATTR_RECV_TIMEOUT]);
As nla_get_msecs() is essentially nla_get_u64() plus the
conversion to a HZ-based value, this will not properly
reject attributes from userspace that aren't long enough
and might overrun the message.
Add NLA_MSECS to the attribute minlen array to check the
size properly.
Cc: Thomas Graf <tgraf@suug.ch>
Cc: stable@vger.kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
lib/nlattr.c | 1 +
1 file changed, 1 insertion(+)
--- a/lib/nlattr.c 2011-04-29 11:34:55.000000000 +0200
+++ b/lib/nlattr.c 2011-11-03 11:02:10.000000000 +0100
@@ -20,6 +20,7 @@ static const u16 nla_attr_minlen[NLA_TYP
[NLA_U16] = sizeof(u16),
[NLA_U32] = sizeof(u32),
[NLA_U64] = sizeof(u64),
+ [NLA_MSECS] = sizeof(u64),
[NLA_NESTED] = NLA_HDRLEN,
};
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] netlink: validate NLA_MSECS length
2011-11-03 10:07 [PATCH] netlink: validate NLA_MSECS length Johannes Berg
@ 2011-11-04 21:48 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2011-11-04 21:48 UTC (permalink / raw)
To: johannes; +Cc: netdev, tgraf
From: Johannes Berg <johannes@sipsolutions.net>
Date: Thu, 03 Nov 2011 11:07:32 +0100
> From: Johannes Berg <johannes.berg@intel.com>
>
> L2TP for example uses NLA_MSECS like this:
> policy:
> [L2TP_ATTR_RECV_TIMEOUT] = { .type = NLA_MSECS, },
> code:
> if (info->attrs[L2TP_ATTR_RECV_TIMEOUT])
> cfg.reorder_timeout = nla_get_msecs(info->attrs[L2TP_ATTR_RECV_TIMEOUT]);
>
> As nla_get_msecs() is essentially nla_get_u64() plus the
> conversion to a HZ-based value, this will not properly
> reject attributes from userspace that aren't long enough
> and might overrun the message.
>
> Add NLA_MSECS to the attribute minlen array to check the
> size properly.
>
> Cc: Thomas Graf <tgraf@suug.ch>
> Cc: stable@vger.kernel.org
> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Applied, thanks!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-11-04 21:50 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-11-03 10:07 [PATCH] netlink: validate NLA_MSECS length Johannes Berg
2011-11-04 21:48 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.