From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Message-Id: <20111102221454.612949436@clark.kroah.org> Date: Wed, 02 Nov 2011 15:14:15 -0700 From: Greg KH To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Matthew Daley , Eric Dumazet , Andrew Hendry , "David S. Miller" Subject: [049/107] x25: Prevent skb overreads when checking call user data In-Reply-To: <20111102221600.GA26650@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: 2.6.32-longterm review patch. If anyone has any objections, please let us know. ------------------ From: Matthew Daley commit 7f81e25befdfb3272345a2e775f520e1d515fa20 upstream. x25_find_listener does not check that the amount of call user data given in the skb is big enough in per-socket comparisons, hence buffer overreads may occur. Fix this by adding a check. Signed-off-by: Matthew Daley Cc: Eric Dumazet Cc: Andrew Hendry Acked-by: Andrew Hendry Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/x25/af_x25.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/net/x25/af_x25.c +++ b/net/x25/af_x25.c @@ -294,7 +294,8 @@ static struct sock *x25_find_listener(st * Found a listening socket, now check the incoming * call user data vs this sockets call user data */ - if(skb->len > 0 && x25_sk(s)->cudmatchlength > 0) { + if (x25_sk(s)->cudmatchlength > 0 && + skb->len >= x25_sk(s)->cudmatchlength) { if((memcmp(x25_sk(s)->calluserdata.cuddata, skb->data, x25_sk(s)->cudmatchlength)) == 0) {