Re: [PATCH] ieee802154: verify packet size before trying to allocate it
flat view
From: Alan Cox <hidden>
Date: 2012-06-10 11:21:16
Also in:
lkml
On Sun, 10 Jun 2012 13:10:19 +0200 Sasha Levin [off-list ref] wrote:
quoted hunk ↗ jump to hunk
Currently when sending data over datagram, the send function will attempt to allocate any size passed on from the userspace. We should make sure that this size is checked and limited. The maximum size of an IP packet seemed like the safest limit here. Signed-off-by: Sasha Levin <redacted> --- Change in v2: - Limit by maximum size the protocol supports. net/ieee802154/dgram.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-)diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c index 6fbb2ad..628498c 100644 --- a/net/ieee802154/dgram.c +++ b/net/ieee802154/dgram.c@@ -232,6 +232,11 @@ static int dgram_sendmsg(struct kiocb *iocb, struct sock *sk, hlen = LL_RESERVED_SPACE(dev); tlen = dev->needed_tailroom; + if (hlen + tlen + size > IEEE802154_MTU) { + err = -EMSGSIZE; + goto out;
What stops an overflow at this point. We'll then pass a small value to sock_alloc_send_skb/sock_alloc_send_pskb and copy a large number of bytes into it. This does seem to be already broken, and not fixed by the patch ? Alan