]>
Commit | Line | Data |
---|---|---|
db1faad6 GKH |
1 | From c30bc94758ae2a38a5eb31767c1985c0aae0950b Mon Sep 17 00:00:00 2001 |
2 | From: Johannes Berg <johannes.berg@intel.com> | |
3 | Date: Thu, 3 Nov 2011 00:07:32 +0000 | |
4 | Subject: netlink: validate NLA_MSECS length | |
5 | ||
6 | From: Johannes Berg <johannes.berg@intel.com> | |
7 | ||
8 | commit c30bc94758ae2a38a5eb31767c1985c0aae0950b upstream. | |
9 | ||
10 | L2TP for example uses NLA_MSECS like this: | |
11 | policy: | |
12 | [L2TP_ATTR_RECV_TIMEOUT] = { .type = NLA_MSECS, }, | |
13 | code: | |
14 | if (info->attrs[L2TP_ATTR_RECV_TIMEOUT]) | |
15 | cfg.reorder_timeout = nla_get_msecs(info->attrs[L2TP_ATTR_RECV_TIMEOUT]); | |
16 | ||
17 | As nla_get_msecs() is essentially nla_get_u64() plus the | |
18 | conversion to a HZ-based value, this will not properly | |
19 | reject attributes from userspace that aren't long enough | |
20 | and might overrun the message. | |
21 | ||
22 | Add NLA_MSECS to the attribute minlen array to check the | |
23 | size properly. | |
24 | ||
25 | Cc: Thomas Graf <tgraf@suug.ch> | |
26 | Signed-off-by: Johannes Berg <johannes.berg@intel.com> | |
27 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
28 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | |
29 | ||
30 | --- | |
31 | lib/nlattr.c | 1 + | |
32 | 1 file changed, 1 insertion(+) | |
33 | ||
34 | --- a/lib/nlattr.c | |
35 | +++ b/lib/nlattr.c | |
36 | @@ -20,6 +20,7 @@ static const u16 nla_attr_minlen[NLA_TYP | |
37 | [NLA_U16] = sizeof(u16), | |
38 | [NLA_U32] = sizeof(u32), | |
39 | [NLA_U64] = sizeof(u64), | |
40 | + [NLA_MSECS] = sizeof(u64), | |
41 | [NLA_NESTED] = NLA_HDRLEN, | |
42 | }; | |
43 |