New: af_rose sendmsg length check

Bugme-new Andrew Morton 1 participant 1 message Apr 8, 2008 1 message not in the archive

Subsystems (2)

Networking Network drivers

lore

Share & tools

lore

A message that is not in the archive (sent off-list or not yet received): [email protected]/

Andrew Morton

author

2008-04-08 17:39 UTC #1 lore raw

(switched to email. Please respond via emailed reply-to-all, not via the bugzilla web interface).

Quoted 28 lines · On Tue, 8 Apr 2008 06:48:27 -0700 (PDT) [email protected] wrote:

http://bugzilla.kernel.org/show_bug.cgi?id=10423
           Summary: af_rose sendmsg length check
           Product: Networking
           Version: 2.5
     KernelVersion: 2.6.24.4
          Platform: All
        OS/Version: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: Other
        AssignedTo: [email protected]
        ReportedBy: [email protected]
Hi,
the code from rose_sendmsg in sys/net/af_rose.c doesn't check the value of len. suppose len is very big (0xfffffff8 for example) then "size" would overflow.
        size = len + AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN;
resulting in a buffer that's too small.
if ((skb = sock_alloc_send_skb(sk, size, msg->msg_flags & MSG_DONTWAIT, &err)) == NULL)

Quoted 10 lines

                return err;
the buffer is filled here:
1115 skb_put(skb, len);
1116
1117 err = memcpy_fromiovec(skb_transport_header(skb), msg->msg_iov,
len);

It might be that it doesn't need to check. We check that the total length didn't overflow negative in sys_sendmsg()'s call to verify_iovec().

Of course, the addition which you identify might make a very large length overflow 0x7fffffff, and subsequent code might handle that incorrectly.