From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: stable-review@vger.kernel.org, torvalds@linux-foundation.org,
akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
Matthew Daley <mattjd@gmail.com>,
Eric Dumazet <eric.dumazet@gmail.com>,
Andrew Hendry <andrew.hendry@gmail.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [24/27] x25: Prevent skb overreads when checking call user data
Date: Sun, 23 Oct 2011 08:24:52 +0200 [thread overview]
Message-ID: <20111023062541.020899214@pistachio.kroah.org> (raw)
In-Reply-To: <20111023062833.GA8126@kroah.com>
3.0-stable review patch. If anyone has any objections, please let us know.
------------------
From: Matthew Daley <mattjd@gmail.com>
commit 7f81e25befdfb3272345a2e775f520e1d515fa20 upstream.
x25_find_listener does not check that the amount of call user data given
in the skb is big enough in per-socket comparisons, hence buffer
overreads may occur. Fix this by adding a check.
Signed-off-by: Matthew Daley <mattjd@gmail.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Andrew Hendry <andrew.hendry@gmail.com>
Acked-by: Andrew Hendry <andrew.hendry@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
net/x25/af_x25.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -295,7 +295,8 @@ static struct sock *x25_find_listener(st
* Found a listening socket, now check the incoming
* call user data vs this sockets call user data
*/
- if(skb->len > 0 && x25_sk(s)->cudmatchlength > 0) {
+ if (x25_sk(s)->cudmatchlength > 0 &&
+ skb->len >= x25_sk(s)->cudmatchlength) {
if((memcmp(x25_sk(s)->calluserdata.cuddata,
skb->data,
x25_sk(s)->cudmatchlength)) == 0) {
next prev parent reply other threads:[~2011-10-23 6:34 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-10-23 6:28 [00/27] 3.0.8-stable review Greg KH
2011-10-23 6:24 ` [01/27] ARM: 7113/1: mm: Align bank start to MAX_ORDER_NR_PAGES Greg KH
2011-10-23 6:24 ` [02/27] ARM: 7117/1: perf: fix HW_CACHE_* events on Cortex-A9 Greg KH
2011-10-23 6:24 ` [03/27] HID: usbhid: Add support for SiGma Micro chip Greg KH
2011-10-23 6:24 ` [04/27] hwmon: (w83627ehf) Properly report thermal diode sensors Greg KH
2011-10-23 6:24 ` [05/27] Avoid using variable-length arrays in kernel/sys.c Greg KH
2011-10-23 6:24 ` [06/27] drm/radeon/kms/atom: fix handling of FB scratch indices Greg KH
2011-10-23 6:24 ` [07/27] cputimer: Cure lock inversion Greg KH
2011-10-23 6:24 ` [08/27] fuse: fix memory leak Greg KH
2011-10-23 6:24 ` [09/27] Platform: fix samsung-laptop DMI identification for N150/N210/220/N230 Greg KH
2011-10-23 6:24 ` [10/27] HID: magicmouse: ignore ivalid report id while switching modes, v2 Greg KH
2011-10-23 6:24 ` [11/27] [media] uvcvideo: Fix crash when linking entities Greg KH
2011-10-23 6:24 ` [12/27] hfsplus: ensure bio requests are not smaller than the hardware sectors Greg KH
2011-10-23 6:24 ` [13/27] drm/ttm: ensure ttm for new node is bound before calling move_notify() Greg KH
2011-10-23 6:24 ` [14/27] drm/ttm: unbind ttm before destroying node in accel move cleanup Greg KH
2011-10-23 6:24 ` [15/27] CIFS: Fix ERR_PTR dereference in cifs_get_root Greg KH
2011-10-23 6:24 ` [16/27] xfs: start periodic workers later Greg KH
2011-10-23 6:24 ` [17/27] xfs: use a cursor for bulk AIL insertion Greg KH
2011-10-23 6:24 ` [18/27] xfs: do not update xa_last_pushed_lsn for locked items Greg KH
2011-10-23 6:24 ` [19/27] xfs: force the log if we encounter pinned buffers in .iop_pushbuf Greg KH
2011-10-23 6:24 ` [20/27] xfs: revert to using a kthread for AIL pushing Greg KH
2011-10-23 6:24 ` [21/27] firewire: sbp2: fix panic after rmmod with slow targets Greg KH
2011-10-23 6:24 ` [22/27] VFS: Fix automount for negative autofs dentries Greg KH
2011-10-23 7:35 ` Linus Torvalds
2011-10-23 8:36 ` Greg KH
2011-10-23 21:09 ` Miklos Szeredi
2011-10-24 14:22 ` Greg KH
2011-10-23 11:59 ` Ian Kent
2011-11-01 15:51 ` David Howells
2011-10-23 11:41 ` Ian Kent
2011-10-23 11:48 ` Greg KH
2011-10-23 12:07 ` Ian Kent
2011-10-23 6:24 ` [23/27] mm: fix race between mremap and removing migration entry Greg KH
2011-10-23 6:24 ` Greg KH [this message]
2011-10-23 6:24 ` [25/27] crypto: ghash - Avoid null pointer dereference if no key is set Greg KH
2011-10-23 6:24 ` [26/27] ALSA: HDA: conexant support for Lenovo T520/W520 Greg KH
2011-10-23 6:24 ` [27/27] ALSA: hda - Add position_fix quirk for Dell Inspiron 1010 Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20111023062541.020899214@pistachio.kroah.org \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=andrew.hendry@gmail.com \
--cc=davem@davemloft.net \
--cc=eric.dumazet@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mattjd@gmail.com \
--cc=stable-review@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®