Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1558330
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.9 16/59] rtnl: stats - add missing netlink message size checks |
| Date | 2017-01-13 13:10 +0100 |
| Message-ID | <sZ8Qd-HA-91@gated-at.bofh.it> (permalink) |
| References | <sZ8Q9-HA-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <minipli@googlemail.com>
[ Upstream commit 4775cc1f2d5abca894ac32774eefc22c45347d1c ]
We miss to check if the netlink message is actually big enough to contain
a struct if_stats_msg.
Add a check to prevent userland from sending us short messages that would
make us access memory beyond the end of the message.
Fixes: 10c9ead9f3c6 ("rtnetlink: add new RTM_GETSTATS message to dump...")
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Roopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/rtnetlink.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -3886,6 +3886,9 @@ static int rtnl_stats_get(struct sk_buff
u32 filter_mask;
int err;
+ if (nlmsg_len(nlh) < sizeof(*ifsm))
+ return -EINVAL;
+
ifsm = nlmsg_data(nlh);
if (ifsm->ifindex > 0)
dev = __dev_get_by_index(net, ifsm->ifindex);
@@ -3935,6 +3938,9 @@ static int rtnl_stats_dump(struct sk_buf
cb->seq = net->dev_base_seq;
+ if (nlmsg_len(cb->nlh) < sizeof(*ifsm))
+ return -EINVAL;
+
ifsm = nlmsg_data(cb->nlh);
filter_mask = ifsm->filter_mask;
if (!filter_mask)
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.9 00/59] 4.9.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 46/59] ARM: zynq: Reserve correct amount of non-DMA RAM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 50/59] ARM: OMAP5: Fix mpuss_early_init Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 47/59] ARM: qcom_defconfig: Fix MDM9515 LCC and GCC config Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 32/59] gro: Enter slow-path if there is no tailroom Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 35/59] net/mlx5e: Remove WARN_ONCE from adaptive moderation code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 28/59] r8152: split rtl8152_suspend function Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 17/59] net: fix incorrect original ingress device index in PKTINFO Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 33/59] gro: use min_t() in skb_gro_reset_offset() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 59/59] rtlwifi: rtl_usb: Fix missing entry in USB drivers private data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 08/59] net/sched: cls_flower: Fix missing addr_type in classify Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 39/59] ALSA: firewire-tascam: Fix to handle error from initialization of stream data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 53/59] ARM: 8631/1: clkdev: Detect errors in clk_hw_register_clkdev() for mass registration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 29/59] r8152: fix rx issue for runtime suspend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 26/59] net: dsa: bcm_sf2: Do not clobber b53_switch_ops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 58/59] rtlwifi: Fix enter/exit power_save Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 23/59] ipv4: Do not allow MAIN to be alias for new LOCAL w/ custom rules Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 19/59] drop_monitor: add missing call to genlmsg_end Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 42/59] arm64: dts: mt8173: Fix auxadc node Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 13/59] net/mlx5: Prevent setting multicast macs for VFs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 02/59] net: vrf: Drop conntrack data after pass through VRF device on Tx Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 05/59] ipv6: handle -EFAULT from skb_copy_bits Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 30/59] net: dsa: Ensure validity of dst->ds[0] Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 54/59] ARM: omap2+: am437x: rollback to use omap3_gptimer_timer_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 10/59] net/mlx5: Cancel recovery work in remove flow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 06/59] net, sched: fix soft lockup in tc_classify Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 52/59] ARM: OMAP4+: Fix bad fallthrough for cpuidle Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 01/59] net: vrf: Fix NAT within a VRF Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 16/59] rtnl: stats - add missing netlink message size checks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 12/59] net/mlx5: Mask destination mac value in ethtool steering rules Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 07/59] net: stmmac: Fix race between stmmac_drv_probe and stmmac_open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 27/59] net: dsa: bcm_sf2: Utilize nested MDIO read/write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 48/59] svcrdma: Clear xpt_bc_xps in xprt_setup_rdma_bc() error exit arm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 38/59] HID: hid-cypress: validate length of report Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 11/59] net/mlx5: Avoid shadowing numa_node Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 51/59] ARM: OMAP5: Fix build for PM code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 22/59] igmp: Make igmp group member RFC 3376 compliant Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 24/59] net: vrf: Add missing Rx counters Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 56/59] ALSA: usb-audio: Add a quirk for Plantronics BT600 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:10 +0100
[PATCH 4.9 21/59] flow_dissector: Update pptp handling to avoid null pointer deref. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 41/59] tools/virtio: fix READ_ONCE() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 49/59] bus: arm-ccn: Prevent hotplug callback leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 03/59] sctp: sctp_transport_lookup_process should rcu_read_unlock when transport is null Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 09/59] net/mlx5: Check FW limitations on log_max_qp before setting it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 04/59] inet: fix IP(V6)_RECVORIGDSTADDR for udp sockets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 20/59] drop_monitor: consider inserted data in genlmsg_end Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 40/59] powerpc: Fix build warning on 32-bit PPC Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 18/59] net: ipv4: dst for local input routes should use l3mdev if relevant Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 45/59] ARM: pxa: fix pxa25x interrupt init Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 37/59] net: vrf: do not allow table id 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 34/59] gro: Disable frag0 optimization on IPv6 ext headers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 15/59] net/mlx5e: Disable netdev after close Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 14/59] net/mlx5e: Dont sync netdev state when not registered Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 25/59] bpf: change back to orig prog on too many passes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 36/59] net: ipv4: Fix multipath selection with vrf Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
[PATCH 4.9 43/59] ARM64: dts: bcm2837-rpi-3-b: remove incorrect pwr LED Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-13 13:20 +0100
Re: [PATCH 4.9 00/59] 4.9.4-stable review Guenter Roeck <linux@roeck-us.net> - 2017-01-13 21:30 +0100
Re: [PATCH 4.9 00/59] 4.9.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-14 08:30 +0100
Re: [PATCH 4.9 00/59] 4.9.4-stable review Shuah Khan <shuah.kh@samsung.com> - 2017-01-13 23:00 +0100
Re: [PATCH 4.9 00/59] 4.9.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-14 08:30 +0100
csiph-web