summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRalf Baechle <ralf@linux-mips.org>2011-11-24 23:08:49 +0000
committerDavid S. Miller <davem@davemloft.net>2011-11-29 00:23:12 -0500
commitac1a1de31515d950f858ba47d2bba74ff9a2614d (patch)
tree3314ca9498e18f4a37b7a818609b15848d07f38b
parentbe639ac6901a082894771f55c8047d5772de5c27 (diff)
downloadlinux-stable-ac1a1de31515d950f858ba47d2bba74ff9a2614d.tar.gz
linux-stable-ac1a1de31515d950f858ba47d2bba74ff9a2614d.tar.bz2
linux-stable-ac1a1de31515d950f858ba47d2bba74ff9a2614d.zip
NET: NETROM: When adding a route verify length of mnemonic string.
struct nr_route_struct's mnemonic permits a string of up to 7 bytes to be used. If userland passes a not zero terminated string to the kernel adding a node to the routing table might result in the kernel attempting to read copy a too long string. Mnemonic is part of the NET/ROM routing protocol; NET/ROM routing table updates only broadcast 6 bytes. The 7th byte in the mnemonic array exists only as a \0 termination character for the kernel code's convenience. Fixed by rejecting mnemonic strings that have no terminating \0 in the first 7 characters. Do this test only NETROM_NODE to avoid breaking NETROM_NEIGH where userland might passing an uninitialized mnemonic field. Initial patch by Dan Carpenter <dan.carpenter@oracle.com>. Signed-off-by: Ralf Baechle <ralf@linux-mips.org> Cc: Dan Carpenter <dan.carpenter@oracle.com> Cc: Walter Harms <wharms@bfs.de> Cc: Thomas Osterried <thomas@osterried.de> Acked-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/netrom/nr_route.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index 915a87ba23e1..8d7716ca5342 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -678,6 +678,11 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
}
switch (nr_route.type) {
case NETROM_NODE:
+ if (strnlen(nr_route.mnemonic, 7) == 7) {
+ ret = -EINVAL;
+ break;
+ }
+
ret = nr_add_node(&nr_route.callsign,
nr_route.mnemonic,
&nr_route.neighbour,