From 4bd7834e412c9f4478f9a17c5f7768d21b87fc63 Mon Sep 17 00:00:00 2001 From: Herbert Xu Date: Mon, 21 Jan 2008 02:14:02 +0200 Subject: [PATCH] [ATM]: Check IP header validity in mpc_send_packet [ Upstream commit: 1c9b7aa1eb40ab708ef3242f74b9a61487623168 ] Al went through the ip_fast_csum callers and found this piece of code that did not validate the IP header. While root crashing the machine by sending bogus packets through raw or AF_PACKET sockets isn't that serious, it is still nice to react gracefully. This patch ensures that the skb has enough data for an IP header and that the header length field is valid. Adrian Bunk: Backported to 2.6.16 following instructions by David Miller. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk --- net/atm/mpc.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/atm/mpc.c b/net/atm/mpc.c index c304ef1513b9..c2d11fe3db10 100644 --- a/net/atm/mpc.c +++ b/net/atm/mpc.c @@ -552,6 +552,13 @@ static int mpc_send_packet(struct sk_buff *skb, struct net_device *dev) if (eth->h_proto != htons(ETH_P_IP)) goto non_ip; /* Multi-Protocol Over ATM :-) */ + /* Weed out funny packets (e.g., AF_PACKET or raw). */ + if (skb->len < ETH_HLEN + sizeof(struct iphdr)) + goto non_ip; + skb->nh.raw = skb->data + ETH_HLEN; + if (skb->len < ETH_HLEN + skb->nh.iph->ihl * 4 || skb->nh.iph->ihl < 5) + goto non_ip; + while (i < mpc->number_of_mps_macs) { if (!compare_ether_addr(eth->h_dest, (mpc->mps_macs + i*ETH_ALEN))) if ( send_via_shortcut(skb, mpc) == 0 ) /* try shortcut */ -- 2.39.5