lkml.org 
[lkml]   [2015]   [Mar]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.14 10/79] inet_diag: fix possible overflow in inet_diag_dump_one_icsk()
    Date
    3.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Eric Dumazet <edumazet@google.com>

    [ Upstream commit c8e2c80d7ec00d020320f905822bf49c5ad85250 ]

    inet_diag_dump_one_icsk() allocates too small skb.

    Add inet_sk_attr_size() helper right before inet_sk_diag_fill()
    so that it can be updated if/when new attributes are added.

    iproute2/ss currently does not use this dump_one() interface,
    this might explain nobody noticed this problem yet.

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/ipv4/inet_diag.c | 18 +++++++++++++++---
    1 file changed, 15 insertions(+), 3 deletions(-)

    --- a/net/ipv4/inet_diag.c
    +++ b/net/ipv4/inet_diag.c
    @@ -71,6 +71,20 @@ static inline void inet_diag_unlock_hand
    mutex_unlock(&inet_diag_table_mutex);
    }

    +static size_t inet_sk_attr_size(void)
    +{
    + return nla_total_size(sizeof(struct tcp_info))
    + + nla_total_size(1) /* INET_DIAG_SHUTDOWN */
    + + nla_total_size(1) /* INET_DIAG_TOS */
    + + nla_total_size(1) /* INET_DIAG_TCLASS */
    + + nla_total_size(sizeof(struct inet_diag_meminfo))
    + + nla_total_size(sizeof(struct inet_diag_msg))
    + + nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
    + + nla_total_size(TCP_CA_NAME_MAX)
    + + nla_total_size(sizeof(struct tcpvegas_info))
    + + 64;
    +}
    +
    int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
    struct sk_buff *skb, struct inet_diag_req_v2 *req,
    struct user_namespace *user_ns,
    @@ -324,9 +338,7 @@ int inet_diag_dump_one_icsk(struct inet_
    if (err)
    goto out;

    - rep = nlmsg_new(sizeof(struct inet_diag_msg) +
    - sizeof(struct inet_diag_meminfo) +
    - sizeof(struct tcp_info) + 64, GFP_KERNEL);
    + rep = nlmsg_new(inet_sk_attr_size(), GFP_KERNEL);
    if (!rep) {
    err = -ENOMEM;
    goto out;



    \
     
     \ /
      Last update: 2015-03-24 17:01    [W:4.723 / U:0.096 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site