From: "Ilpo_Järvinen" <[EMAIL PROTECTED]> Date: Tue, 19 Jun 2007 01:25:57 +0300
> From: =?ISO-8859-1?q?Ilpo_J=E4rvinen?= <[EMAIL PROTECTED]> > > SACK processing code has been sort of russian roulette as no > validation of SACK blocks is previously attempted. It is not > very clear what all kinds of broken SACK blocks really mean > (e.g., one that has start and end sequence numbers reversed). > > This fixes also one remote triggerable NULL-ptr access: > start_seq was trusted as a valid mark_lost_entry_seq but > without validation it is relatively easy to inject an invalid > sequence number there that will cause a crash in the lost > marker code. Other SACK processing code seems safe so this could > have been fixed locally but that would leave SACK processing > hazardous in case of future modifications. IMHO, it's just > better to close the whole roulette rather than disarming just > one bullet. > > Signed-off-by: Ilpo Järvinen <[EMAIL PROTECTED]> This looks good applied. Does mainline 2.6.x has this NULL-ptr issues too? If so we'll have to fix it there very soon. - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
