Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1c9b7aa1 authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller
Browse files

[ATM]: Check IP header validity in mpc_send_packet 



Al went through the ip_fast_csum callers and found this piece of code
that did not validate the IP header.  While root crashing the machine
by sending bogus packets through raw or AF_PACKET sockets isn't that
serious, it is still nice to react gracefully.

This patch ensures that the skb has enough data for an IP header and
that the header length field is valid.

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1ac4f008

net/atm/mpc.c

+7 −0
Original line number Original line Diff line number Diff line
@@ -542,6 +542,13 @@ static int mpc_send_packet(struct sk_buff *skb, struct net_device *dev) 
	if (eth->h_proto != htons(ETH_P_IP))

	if (eth->h_proto != htons(ETH_P_IP))

		goto non_ip; /* Multi-Protocol Over ATM :-) */

		goto non_ip; /* Multi-Protocol Over ATM :-) */





	/* Weed out funny packets (e.g., AF_PACKET or raw). */

	if (skb->len < ETH_HLEN + sizeof(struct iphdr))

		goto non_ip;

	skb_set_network_header(skb, ETH_HLEN);

	if (skb->len < ETH_HLEN + ip_hdr(skb)->ihl * 4 || ip_hdr(skb)->ihl < 5)

		goto non_ip;



	while (i < mpc->number_of_mps_macs) {

	while (i < mpc->number_of_mps_macs) {

		if (!compare_ether_addr(eth->h_dest, (mpc->mps_macs + i*ETH_ALEN)))

		if (!compare_ether_addr(eth->h_dest, (mpc->mps_macs + i*ETH_ALEN)))

			if ( send_via_shortcut(skb, mpc) == 0 )           /* try shortcut */

			if ( send_via_shortcut(skb, mpc) == 0 )           /* try shortcut */