Catch wrong RTATTR_MAX with BUG()

Catches outdated/invalid RTATTR_MAX and therefore avoids possible stack corruption.

@@ -450,6 +450,9 @@
 	sz_idx = type>>2;
 	kind = type&3;
 
+	if (RTATTR_MAX < rta_max[sz_idx])
+		BUG();
+
 	if (kind != 2 && security_netlink_recv(skb)) {
 		*errp = -EPERM;
 		return -1;

Your test has an off by one error, but more importantly, it's probably better to do this at compile time with something like:

extern void rtattr_max_too_small(void);

...

void __init rtnetlink_init(void)

{
	if (IFLA_MAX > RTATTR_MAX ||
	    IFA_MAX > RTATTR_MAX ||
	    RTA_MAX > RTATTR_MAX ||
	    NDA_MAX > RTATTR_MAX ||
	    TCA_MAX > RTATTR_MAX ||
	    TCAA_MAX > RTATTR_MAX)
		rtattr_max_too_small();

I would therefore accept a patch that did things this way. BUG()'ing at runtime for something like this is too rude. :)

Thanks.

In article <[email protected]> (at Thu, 9 Sep 2004 18:43:46 +0200), Thomas Graf <[email protected]> says:

	if (rta_max[sz_idx] > RTATTR_MAX)
		goto err_inval;

Hideaki YOSHIFUJI @ USAGI Project <[email protected]>
GPG FP: 9022 65EB 1ECF 3AD1 0BDF  80D8 4807 F894 E062 0EEA