From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932303Ab1KWAeM (ORCPT ); Tue, 22 Nov 2011 19:34:12 -0500 Received: from cantor2.suse.de ([195.135.220.15]:42208 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1759036Ab1KWAeG (ORCPT ); Tue, 22 Nov 2011 19:34:06 -0500 X-Mailbox-Line: From gregkh@clark.kroah.org Tue Nov 22 16:22:07 2011 Message-Id: <20111123002207.381859654@clark.kroah.org> User-Agent: quilt/0.48-20.1.2 Date: Tue, 22 Nov 2011 16:20:54 -0800 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: stable-review@kernel.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Thomas Graf , Johannes Berg , "David S. Miller" Subject: [04/25] netlink: validate NLA_MSECS length In-Reply-To: <20111123002222.GA2376@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 2.6.32-longterm review patch. If anyone has any objections, please let me know. ------------------ Content-Length: 1138 Lines: 39 From: Johannes Berg commit c30bc94758ae2a38a5eb31767c1985c0aae0950b upstream. L2TP for example uses NLA_MSECS like this: policy: [L2TP_ATTR_RECV_TIMEOUT] = { .type = NLA_MSECS, }, code: if (info->attrs[L2TP_ATTR_RECV_TIMEOUT]) cfg.reorder_timeout = nla_get_msecs(info->attrs[L2TP_ATTR_RECV_TIMEOUT]); As nla_get_msecs() is essentially nla_get_u64() plus the conversion to a HZ-based value, this will not properly reject attributes from userspace that aren't long enough and might overrun the message. Add NLA_MSECS to the attribute minlen array to check the size properly. Cc: Thomas Graf Signed-off-by: Johannes Berg Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- lib/nlattr.c | 1 + 1 file changed, 1 insertion(+) --- a/lib/nlattr.c +++ b/lib/nlattr.c @@ -20,6 +20,7 @@ static u16 nla_attr_minlen[NLA_TYPE_MAX+ [NLA_U16] = sizeof(u16), [NLA_U32] = sizeof(u32), [NLA_U64] = sizeof(u64), + [NLA_MSECS] = sizeof(u64), [NLA_NESTED] = NLA_HDRLEN, };