From patchwork Thu Mar 26 21:58:51 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alan Cox X-Patchwork-Id: 25180 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by ozlabs.org (Postfix) with ESMTP id 207E7DDE1A for ; Fri, 27 Mar 2009 08:57:56 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758593AbZCZV5v (ORCPT ); Thu, 26 Mar 2009 17:57:51 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1754080AbZCZV5v (ORCPT ); Thu, 26 Mar 2009 17:57:51 -0400 Received: from earthlight.etchedpixels.co.uk ([81.2.110.250]:56891 "EHLO www.etchedpixels.co.uk" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1757424AbZCZV5u (ORCPT ); Thu, 26 Mar 2009 17:57:50 -0400 Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by www.etchedpixels.co.uk (8.14.3/8.14.3) with ESMTP id n2QLwp6i018871; Thu, 26 Mar 2009 21:58:51 GMT From: Alan Cox Subject: [PATCH] af_rose/x25: Sanity check the maximum user frame size To: linux-kernel@vger.kernel.org, netdev@vger.kernel.org Date: Thu, 26 Mar 2009 21:58:51 +0000 Message-ID: <20090326215826.18836.86957.stgit@localhost.localdomain> User-Agent: StGIT/0.14.3 MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Otherwise we can wrap the sizes and end up sending garbage. Closes #10423 Signed-off-by: Alan Cox --- net/netrom/af_netrom.c | 6 +++++- net/rose/af_rose.c | 4 ++++ net/x25/af_x25.c | 6 ++++++ 3 files changed, 15 insertions(+), 1 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index e9c05b8..29953b0 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -1082,7 +1082,11 @@ static int nr_sendmsg(struct kiocb *iocb, struct socket *sock, SOCK_DEBUG(sk, "NET/ROM: sendto: Addresses built.\n"); - /* Build a packet */ + /* Build a packet - the conventional user limit is 236 bytes. We can + do ludicrously large NetROM frames but must not overflow */ + if (len > 65536) + return -EMSGSIZE; + SOCK_DEBUG(sk, "NET/ROM: sendto: building packet.\n"); size = len + NR_NETWORK_LEN + NR_TRANSPORT_LEN; diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c index 0139264..5e75bbf 100644 --- a/net/rose/af_rose.c +++ b/net/rose/af_rose.c @@ -1124,6 +1124,10 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock, /* Build a packet */ SOCK_DEBUG(sk, "ROSE: sendto: building packet.\n"); + /* Sanity check the packet size */ + if (len > 65535) + return -EMSGSIZE; + size = len + AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + ROSE_MIN_LEN; if ((skb = sock_alloc_send_skb(sk, size, msg->msg_flags & MSG_DONTWAIT, &err)) == NULL) diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c index 9fc5b02..88d80f5 100644 --- a/net/x25/af_x25.c +++ b/net/x25/af_x25.c @@ -1037,6 +1037,12 @@ static int x25_sendmsg(struct kiocb *iocb, struct socket *sock, sx25.sx25_addr = x25->dest_addr; } + /* Sanity check the packet size */ + if (len > 65535) { + rc = -EMSGSIZE; + goto out; + } + SOCK_DEBUG(sk, "x25_sendmsg: sendto: Addresses built.\n"); /* Build a packet */