From: Holger Eitzenberger <[EMAIL PROTECTED]> Date: Tue, 18 Sep 2007 23:05:52 +0200
> Holger Eitzenberger <[EMAIL PROTECTED]> writes: > > > while going through going netlink code I found out that netlink_bind() > > does not properly check bind parameters. I checked both 2.6.23-rc1 as > > well as 2.6.16.53, both are affected. > > > > With a small test prog I wasn't able to crash my maschine though, but > > data was accessed out of bounds. > > See my attached patch, thanks. Your patch is incorrect and also unnecessary. Firstly, you patch compares the address _pointer_ against the minimum length. That's obviously wrong. And if you check the call sites of the protocol ->bind() methods, they all use on-stack buffer for the address object which is at least MAX_SOCK_ADDR bytes in length so that the bind methods don't have to check the size if they don't want to. - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
