diff options
| author |   Robert Shearman <rshearma@brocade.com> | 2015-03-06 10:47:00 +0000 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2015-03-06 15:19:06 -0500 |
| commit | f8d54afc4c7a4c41deaa43fbcfffc2976094d342 (patch) | |
| tree | bd55bad628a3ddcbc94d6d75131f318732aec60a /net/mpls | |
| parent | Merge branch 'bcmgenet-next' (diff) | |
| download | linux-dev-f8d54afc4c7a4c41deaa43fbcfffc2976094d342.tar.xz linux-dev-f8d54afc4c7a4c41deaa43fbcfffc2976094d342.zip | |
mpls: Properly validate RTA_VIA payload length
If the nla length is less than 2 then the nla data could be accessed
beyond the accessible bounds. So ensure that the nla is big enough to
at least read the via_family before doing so. Replace magic value of
2.
Fixes: 03c0566542f4 ("mpls: Basic support for adding and removing routes")
Cc: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Robert Shearman <rshearma@brocade.com>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/mpls')
| -rw-r--r-- | net/mpls/af_mpls.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c index 20cf48a8593d..4f265c677eca 100644 --- a/net/mpls/af_mpls.c +++ b/net/mpls/af_mpls.c @@ -586,8 +586,11 @@ static int rtm_to_route_config(struct sk_buff *skb, struct nlmsghdr *nlh, case RTA_VIA: { struct rtvia *via = nla_data(nla); + if (nla_len(nla) < offsetof(struct rtvia, rtvia_addr)) + goto errout; cfg->rc_via_family = via->rtvia_family; - cfg->rc_via_alen = nla_len(nla) - 2; + cfg->rc_via_alen = nla_len(nla) - + offsetof(struct rtvia, rtvia_addr); if (cfg->rc_via_alen > MAX_VIA_ALEN) goto errout; |