From: "Ilpo_Järvinen" <[EMAIL PROTECTED]>
Date: Tue, 19 Jun 2007 01:25:57 +0300

> From: =?ISO-8859-1?q?Ilpo_J=E4rvinen?= <[EMAIL PROTECTED]>
> 
> SACK processing code has been sort of russian roulette as no
> validation of SACK blocks is previously attempted. It is not
> very clear what all kinds of broken SACK blocks really mean
> (e.g., one that has start and end sequence numbers reversed).
> 
> This fixes also one remote triggerable NULL-ptr access:
> start_seq was trusted as a valid mark_lost_entry_seq but
> without validation it is relatively easy to inject an invalid
> sequence number there that will cause a crash in the lost
> marker code. Other SACK processing code seems safe so this could
> have been fixed locally but that would leave SACK processing
> hazardous in case of future modifications. IMHO, it's just
> better to close the whole roulette rather than disarming just
> one bullet.
> 
> Signed-off-by: Ilpo Järvinen <[EMAIL PROTECTED]>

This looks good applied.

Does mainline 2.6.x has this NULL-ptr issues too?  If so
we'll have to fix it there very soon.
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to