Commit 4775cc1f authored Dec 28, 2016 by Mathias Krause Committed by David S. Miller Dec 29, 2016

rtnl: stats - add missing netlink message size checks



We miss to check if the netlink message is actually big enough to contain
a struct if_stats_msg.

Add a check to prevent userland from sending us short messages that would
make us access memory beyond the end of the message.

Fixes: 10c9ead9 ("rtnetlink: add new RTM_GETSTATS message to dump...")
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Roopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent b2eb09af

net/core/rtnetlink.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -3898,6 +3898,9 @@ static int rtnl_stats_get(struct sk_buff skb, struct nlmsghdr nlh)
		u32 filter_mask;
		int err;

		if (nlmsg_len(nlh) < sizeof(*ifsm))
		return -EINVAL;

		ifsm = nlmsg_data(nlh);
		if (ifsm->ifindex > 0)
		dev = __dev_get_by_index(net, ifsm->ifindex);
		@@ -3947,6 +3950,9 @@ static int rtnl_stats_dump(struct sk_buff skb, struct netlink_callback cb)

		cb->seq = net->dev_base_seq;

		if (nlmsg_len(cb->nlh) < sizeof(*ifsm))
		return -EINVAL;

		ifsm = nlmsg_data(cb->nlh);
		filter_mask = ifsm->filter_mask;
		if (!filter_mask)