[PATCH 2.6 NET] Catch wrong RTATTR_MAX with BUG()

[PATCH 2.6 NET] Catch wrong RTATTR_MAX with BUG()

[Thomas Graf]

Catches outdated/invalid RTATTR_MAX and therefore avoids possible stack
corruption.

Signed-off-by: Thomas Graf <tgraf@suug.ch>

--- linux-2.6.9-rc1-bk15.orig/net/core/rtnetlink.c	2004-09-08 18:33:42.000000000 +0200
+++ linux-2.6.9-rc1-bk15/net/core/rtnetlink.c	2004-09-09 18:18:22.000000000 +0200
@@ -450,6 +450,9 @@
 	sz_idx = type>>2;
 	kind = type&3;
 
+	if (RTATTR_MAX < rta_max[sz_idx])
+		BUG();
+
 	if (kind != 2 && security_netlink_recv(skb)) {
 		*errp = -EPERM;
 		return -1;

Re: [PATCH 2.6 NET] Catch wrong RTATTR_MAX with BUG()

[David S. Miller]

On Thu, 9 Sep 2004 18:43:46 +0200
Thomas Graf <tgraf@suug.ch> wrote:

> Catches outdated/invalid RTATTR_MAX and therefore avoids possible stack
> corruption.

Your test has an off by one error, but more importantly,
it's probably better to do this at compile time with
something like:

extern void rtattr_max_too_small(void);

...

void __init rtnetlink_init(void)
{
	if (IFLA_MAX > RTATTR_MAX ||
	    IFA_MAX > RTATTR_MAX ||
	    RTA_MAX > RTATTR_MAX ||
	    NDA_MAX > RTATTR_MAX ||
	    TCA_MAX > RTATTR_MAX ||
	    TCAA_MAX > RTATTR_MAX)
		rtattr_max_too_small();

I would therefore accept a patch that did things
this way.  BUG()'ing at runtime for something like
this is too rude. :)

Thanks.

Re: [PATCH 2.6 NET] Catch wrong RTATTR_MAX with BUG()

[YOSHIFUJI Hideaki / 吉藤英明]

In article <20040909164346.GA18994@postel.suug.ch> (at Thu, 9 Sep 2004 18:43:46 +0200), Thomas Graf <tgraf@suug.ch> says:

>  	kind = type&3;
>  
> +	if (RTATTR_MAX < rta_max[sz_idx])
> +		BUG();
> +

Something like:
	if (rta_max[sz_idx] > RTATTR_MAX)
		goto err_inval;

-- 
Hideaki YOSHIFUJI @ USAGI Project <yoshfuji@linux-ipv6.org>
GPG FP: 9022 65EB 1ECF 3AD1 0BDF  80D8 4807 F894 E062 0EEA