Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a30cfa47 authored by David Fries's avatar David Fries Committed by Greg Kroah-Hartman
Browse files

cn: verify msg->len before making callback 



The struct cn_msg len field comes from userspace and needs to be
validated.  More logical to do so here where the cn_msg pointer is
pulled out of the sk_buff than the callback which is passed cn_msg *
and might assume no validation is needed.

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarEvgeniy Polyakov <zbr@ioremap.net>
Signed-off-by: default avatarDavid Fries <David@Fries.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 55c4e640

drivers/connector/connector.c

+6 −0
Original line number Diff line number Diff line
@@ -141,12 +141,18 @@ EXPORT_SYMBOL_GPL(cn_netlink_send); 
 */

static int cn_call_callback(struct sk_buff *skb)

{

	struct nlmsghdr *nlh;

	struct cn_callback_entry *i, *cbq = NULL;

	struct cn_dev *dev = &cdev;

	struct cn_msg *msg = nlmsg_data(nlmsg_hdr(skb));

	struct netlink_skb_parms *nsp = &NETLINK_CB(skb);

	int err = -ENODEV;



	/* verify msg->len is within skb */

	nlh = nlmsg_hdr(skb);

	if (nlh->nlmsg_len < NLMSG_HDRLEN + sizeof(struct cn_msg) + msg->len)

		return -EINVAL;



	spin_lock_bh(&dev->cbdev->queue_lock);

	list_for_each_entry(i, &dev->cbdev->queue_list, callback_entry) {

		if (cn_cb_equal(&i->id.id, &msg->id)) {