From: Matthew Daley <mattjd@gmail.com>
Date: Fri, 14 Oct 2011 18:45:05 +0000 (+0000)
Subject: x25: Prevent skb overreads when checking call user data
X-Git-Tag: v2.6.33.20~54
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a7cb078b62e01a7931dcb37dbb318637f4e8fbdc;p=thirdparty%2Fkernel%2Fstable.git

x25: Prevent skb overreads when checking call user data

commit 7f81e25befdfb3272345a2e775f520e1d515fa20 upstream.

x25_find_listener does not check that the amount of call user data given
in the skb is big enough in per-socket comparisons, hence buffer
overreads may occur.  Fix this by adding a check.

Signed-off-by: Matthew Daley <mattjd@gmail.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Andrew Hendry <andrew.hendry@gmail.com>
Acked-by: Andrew Hendry <andrew.hendry@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 04f83ab50edc7..32422a4a17c0b 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -294,7 +294,8 @@ static struct sock *x25_find_listener(struct x25_address *addr,
 			 * Found a listening socket, now check the incoming
 			 * call user data vs this sockets call user data
 			 */
-			if(skb->len > 0 && x25_sk(s)->cudmatchlength > 0) {
+			if (x25_sk(s)->cudmatchlength > 0 &&
+				skb->len >= x25_sk(s)->cudmatchlength) {
 				if((memcmp(x25_sk(s)->calluserdata.cuddata,
 					skb->data,
 					x25_sk(s)->cudmatchlength)) == 0) {