From: Rusty Russell <rusty@rustcorp.com.au>
To: David Miller <davem@davemloft.net>
Cc: Max Krasnyansky <maxk@qualcomm.com>, netdev@vger.kernel.org
Subject: [PATCH 2/2] net: check for underlength tap writes
Date: Sat, 5 Apr 2008 21:54:33 +1000 [thread overview]
Message-ID: <200804052154.33636.rusty@rustcorp.com.au> (raw)
In-Reply-To: <200804052153.55676.rusty@rustcorp.com.au>
If the user gives a packet under 14 bytes, we'll end up reading off the end
of the skb (not oopsing, just reading off the end).
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
diff -r 99132ad16999 drivers/net/tun.c
--- a/drivers/net/tun.c Sat Apr 05 21:20:32 2008 +1100
+++ b/drivers/net/tun.c Sat Apr 05 22:47:20 2008 +1100
@@ -286,8 +286,11 @@ static __inline__ ssize_t tun_get_user(s
return -EFAULT;
}
- if ((tun->flags & TUN_TYPE_MASK) == TUN_TAP_DEV)
+ if ((tun->flags & TUN_TYPE_MASK) == TUN_TAP_DEV) {
align = NET_IP_ALIGN;
+ if (unlikely(len < ETH_HLEN))
+ return -EINVAL;
+ }
if (!(skb = alloc_skb(len + align, GFP_KERNEL))) {
tun->dev->stats.rx_dropped++;
next prev parent reply other threads:[~2008-04-05 11:55 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-04-05 11:53 [PATCH 1/2] net: make struct tun_struct private to tun.c Rusty Russell
2008-04-05 11:54 ` Rusty Russell [this message]
2008-04-10 18:19 ` [PATCH 2/2] net: check for underlength tap writes Max Krasnyanskiy
2008-04-13 1:51 ` David Miller
2008-04-10 18:18 ` [PATCH 1/2] net: make struct tun_struct private to tun.c Max Krasnyanskiy
2008-04-13 1:49 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200804052154.33636.rusty@rustcorp.com.au \
--to=rusty@rustcorp.com.au \
--cc=davem@davemloft.net \
--cc=maxk@qualcomm.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.