Gitweb:
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1c9b7aa1eb40ab708ef3242f74b9a61487623168
Commit: 1c9b7aa1eb40ab708ef3242f74b9a61487623168
Parent: 1ac4f008857487bf45b709248d71c5b3f4cae7b5
Author: Herbert Xu <[EMAIL PROTECTED]>
AuthorDate: Wed Jan 9 03:51:59 2008 -0800
Committer: David S. Miller <[EMAIL PROTECTED]>
CommitDate: Wed Jan 9 03:51:59 2008 -0800
[ATM]: Check IP header validity in mpc_send_packet
Al went through the ip_fast_csum callers and found this piece of code
that did not validate the IP header. While root crashing the machine
by sending bogus packets through raw or AF_PACKET sockets isn't that
serious, it is still nice to react gracefully.
This patch ensures that the skb has enough data for an IP header and
that the header length field is valid.
Signed-off-by: Herbert Xu <[EMAIL PROTECTED]>
Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
---
net/atm/mpc.c | 7 +++++++
1 files changed, 7 insertions(+), 0 deletions(-)
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 2086396..9c7f712 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -542,6 +542,13 @@ static int mpc_send_packet(struct sk_buff *skb, struct
net_device *dev)
if (eth->h_proto != htons(ETH_P_IP))
goto non_ip; /* Multi-Protocol Over ATM :-) */
+ /* Weed out funny packets (e.g., AF_PACKET or raw). */
+ if (skb->len < ETH_HLEN + sizeof(struct iphdr))
+ goto non_ip;
+ skb_set_network_header(skb, ETH_HLEN);
+ if (skb->len < ETH_HLEN + ip_hdr(skb)->ihl * 4 || ip_hdr(skb)->ihl < 5)
+ goto non_ip;
+
while (i < mpc->number_of_mps_macs) {
if (!compare_ether_addr(eth->h_dest, (mpc->mps_macs +
i*ETH_ALEN)))
if ( send_via_shortcut(skb, mpc) == 0 ) /*
try shortcut */
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
