ipx: header length validation needed

IPX is not checking for non-linear (and short packets) in it's receive routine. This is serious because it may mean it ends up reading past end of skb.

This maybe related to this bug, because sky2 will copy small packets into small skb's.

    http://bugzilla.kernel.org/show_bug.cgi?id=6693

@@ -1642,6 +1642,9 @@
 	if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 		goto out;
 
+	if (!pskb_may_pull(skb, sizeof(struct ipxhdr)))
+		goto drop;
+
 	ipx		= ipx_hdr(skb);
 	ipx_pktsize	= ntohs(ipx->ipx_pktsize);
 	

From: Stephen Hemminger <[email protected]>
Date: Mon, 7 Aug 2006 13:46:36 -0700

This takes care of ipx_rcv() but the rest of the IPX protocol handling still has the problem, so you'll need to meticuliously follow the whole receive path and fix up all the spots that parse subsequent parts of the IPX packet to fix this properly.

For example, take a look at ipxitf_pprop().

This patch will linearize and check there is enough data. It handles the pprop case as well as avoiding a whole audit of the routing code.

@@ -1649,7 +1649,8 @@
 	ipx_pktsize	= ntohs(ipx->ipx_pktsize);
 	
 	/* Too small or invalid header? */
-	if (ipx_pktsize < sizeof(struct ipxhdr) || ipx_pktsize > skb->len)
+	if (ipx_pktsize < sizeof(struct ipxhdr)
+	   || !pskb_may_pull(skb, ipx_pktsize))
 		goto drop;
                         
 	if (ipx->ipx_checksum != IPX_NO_CHECKSUM &&

From: Stephen Hemminger <[email protected]>
Date: Mon, 7 Aug 2006 16:36:02 -0700

Applied, with a minor coding style tidy-up.

Thanks a lot Stephen.

queued to -stable, thanks.

greg k-h