* [PATCH 2.6 NET] Catch wrong RTATTR_MAX with BUG()
@ 2004-09-09 16:43 Thomas Graf
2004-09-09 16:55 ` David S. Miller
2004-09-09 17:24 ` YOSHIFUJI Hideaki / 吉藤英明
0 siblings, 2 replies; 3+ messages in thread
From: Thomas Graf @ 2004-09-09 16:43 UTC (permalink / raw)
To: David S. Miller; +Cc: netdev
Catches outdated/invalid RTATTR_MAX and therefore avoids possible stack
corruption.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
--- linux-2.6.9-rc1-bk15.orig/net/core/rtnetlink.c 2004-09-08 18:33:42.000000000 +0200
+++ linux-2.6.9-rc1-bk15/net/core/rtnetlink.c 2004-09-09 18:18:22.000000000 +0200
@@ -450,6 +450,9 @@
sz_idx = type>>2;
kind = type&3;
+ if (RTATTR_MAX < rta_max[sz_idx])
+ BUG();
+
if (kind != 2 && security_netlink_recv(skb)) {
*errp = -EPERM;
return -1;
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH 2.6 NET] Catch wrong RTATTR_MAX with BUG()
2004-09-09 16:43 [PATCH 2.6 NET] Catch wrong RTATTR_MAX with BUG() Thomas Graf
@ 2004-09-09 16:55 ` David S. Miller
2004-09-09 17:24 ` YOSHIFUJI Hideaki / 吉藤英明
1 sibling, 0 replies; 3+ messages in thread
From: David S. Miller @ 2004-09-09 16:55 UTC (permalink / raw)
To: Thomas Graf; +Cc: netdev
On Thu, 9 Sep 2004 18:43:46 +0200
Thomas Graf <tgraf@suug.ch> wrote:
> Catches outdated/invalid RTATTR_MAX and therefore avoids possible stack
> corruption.
Your test has an off by one error, but more importantly,
it's probably better to do this at compile time with
something like:
extern void rtattr_max_too_small(void);
...
void __init rtnetlink_init(void)
{
if (IFLA_MAX > RTATTR_MAX ||
IFA_MAX > RTATTR_MAX ||
RTA_MAX > RTATTR_MAX ||
NDA_MAX > RTATTR_MAX ||
TCA_MAX > RTATTR_MAX ||
TCAA_MAX > RTATTR_MAX)
rtattr_max_too_small();
I would therefore accept a patch that did things
this way. BUG()'ing at runtime for something like
this is too rude. :)
Thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH 2.6 NET] Catch wrong RTATTR_MAX with BUG()
2004-09-09 16:43 [PATCH 2.6 NET] Catch wrong RTATTR_MAX with BUG() Thomas Graf
2004-09-09 16:55 ` David S. Miller
@ 2004-09-09 17:24 ` YOSHIFUJI Hideaki / 吉藤英明
1 sibling, 0 replies; 3+ messages in thread
From: YOSHIFUJI Hideaki / 吉藤英明 @ 2004-09-09 17:24 UTC (permalink / raw)
To: tgraf; +Cc: davem, netdev, yoshfuji
In article <20040909164346.GA18994@postel.suug.ch> (at Thu, 9 Sep 2004 18:43:46 +0200), Thomas Graf <tgraf@suug.ch> says:
> kind = type&3;
>
> + if (RTATTR_MAX < rta_max[sz_idx])
> + BUG();
> +
Something like:
if (rta_max[sz_idx] > RTATTR_MAX)
goto err_inval;
--
Hideaki YOSHIFUJI @ USAGI Project <yoshfuji@linux-ipv6.org>
GPG FP: 9022 65EB 1ECF 3AD1 0BDF 80D8 4807 F894 E062 0EEA
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2004-09-09 17:24 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-09-09 16:43 [PATCH 2.6 NET] Catch wrong RTATTR_MAX with BUG() Thomas Graf
2004-09-09 16:55 ` David S. Miller
2004-09-09 17:24 ` YOSHIFUJI Hideaki / 吉藤英明
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).