Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965103AbbFJPrV (ORCPT ); Wed, 10 Jun 2015 11:47:21 -0400 Received: from ip4-83-240-67-251.cust.nbox.cz ([83.240.67.251]:36159 "EHLO ip4-83-240-18-248.cust.nbox.cz" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S933851AbbFJP1v (ORCPT ); Wed, 10 Jun 2015 11:27:51 -0400 From: Jiri Slaby To: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org, David Fries , Greg Kroah-Hartman , Jiri Slaby Subject: [PATCH 3.12 012/111] cn: verify msg->len before making callback Date: Wed, 10 Jun 2015 17:26:01 +0200 Message-Id: X-Mailer: git-send-email 2.4.2 In-Reply-To: <93091169a673f49c2574cddf1ef858cf0704f646.1433943052.git.jslaby@suse.cz> References: <93091169a673f49c2574cddf1ef858cf0704f646.1433943052.git.jslaby@suse.cz> In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1855 Lines: 53 From: David Fries 3.12-stable review patch. If anyone has any objections, please let me know. =============== commit a30cfa475d1a26c18f1998ba1e034a4e2ab4c7a8 upstream. The struct cn_msg len field comes from userspace and needs to be validated. More logical to do so here where the cn_msg pointer is pulled out of the sk_buff than the callback which is passed cn_msg * and might assume no validation is needed. Reported-by: Dan Carpenter Acked-by: Evgeniy Polyakov Signed-off-by: David Fries Signed-off-by: Greg Kroah-Hartman Signed-off-by: Jiri Slaby --- drivers/connector/connector.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c index a36749f1e44a..fb1bad083aa9 100644 --- a/drivers/connector/connector.c +++ b/drivers/connector/connector.c @@ -122,12 +122,18 @@ EXPORT_SYMBOL_GPL(cn_netlink_send); */ static int cn_call_callback(struct sk_buff *skb) { + struct nlmsghdr *nlh; struct cn_callback_entry *i, *cbq = NULL; struct cn_dev *dev = &cdev; struct cn_msg *msg = nlmsg_data(nlmsg_hdr(skb)); struct netlink_skb_parms *nsp = &NETLINK_CB(skb); int err = -ENODEV; + /* verify msg->len is within skb */ + nlh = nlmsg_hdr(skb); + if (nlh->nlmsg_len < NLMSG_HDRLEN + sizeof(struct cn_msg) + msg->len) + return -EINVAL; + spin_lock_bh(&dev->cbdev->queue_lock); list_for_each_entry(i, &dev->cbdev->queue_list, callback_entry) { if (cn_cb_equal(&i->id.id, &msg->id)) { -- 2.4.2 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/