Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1339863 > unrolled thread

[patch 1/6] staging: gdm72xx: underflow in netlink_rcv_cb()

Back to article view | Back to linux.kernel

Contents

  [patch 1/6] staging: gdm72xx: underflow in netlink_rcv_cb() Dan Carpenter <dan.carpenter@oracle.com> - 2016-02-22 20:40 +0100

#1339863 — [patch 1/6] staging: gdm72xx: underflow in netlink_rcv_cb()

If nlh->nlmsg_len is less than ND_IFINDEX_LEN we end up trying to memcpy
a negative size.  I also re-ordered slighty the condition to make it
more uniform.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/staging/gdm72xx/netlink_k.c b/drivers/staging/gdm72xx/netlink_k.c
index cf0b47c..4089b17 100644
--- a/drivers/staging/gdm72xx/netlink_k.c
+++ b/drivers/staging/gdm72xx/netlink_k.c
@@ -55,7 +55,8 @@ static void netlink_rcv_cb(struct sk_buff *skb)
 	if (skb->len >= NLMSG_HDRLEN) {
 		nlh = (struct nlmsghdr *)skb->data;
 
-		if (skb->len < nlh->nlmsg_len ||
+		if (nlh->nlmsg_len < ND_IFINDEX_LEN ||
+		    nlh->nlmsg_len > skb->len ||
 		    nlh->nlmsg_len > ND_MAX_MSG_LEN) {
 			netdev_err(skb->dev, "Invalid length (%d,%d)\n",
 				   skb->len, nlh->nlmsg_len);

[toc] | [standalone]

Back to top | Article view | linux.kernel

csiph-web