Johannes Berg 61ec3a5696 netlink: validate NLA_MSECS length
commit c30bc94758ae2a38a5eb31767c1985c0aae0950b upstream.

L2TP for example uses NLA_MSECS like this:
policy:
        [L2TP_ATTR_RECV_TIMEOUT]        = { .type = NLA_MSECS, },
code:
        if (info->attrs[L2TP_ATTR_RECV_TIMEOUT])
                cfg.reorder_timeout = nla_get_msecs(info->attrs[L2TP_ATTR_RECV_TIMEOUT]);

As nla_get_msecs() is essentially nla_get_u64() plus the
conversion to a HZ-based value, this will not properly
reject attributes from userspace that aren't long enough
and might overrun the message.

Add NLA_MSECS to the attribute minlen array to check the
size properly.

Cc: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-11-11 09:44:43 -08:00
..
2011-09-21 13:39:59 -07:00
2011-07-26 16:49:47 -07:00
2011-07-26 16:49:47 -07:00
2008-07-24 10:47:33 -07:00
2011-03-11 14:25:50 +00:00
2011-08-03 11:30:42 -04:00
2008-06-06 11:29:10 -07:00
2011-03-31 11:26:23 -03:00
2007-07-16 09:05:50 -07:00
2007-07-17 10:23:04 -07:00
2011-07-26 16:49:47 -07:00
2007-05-10 18:24:13 +02:00
2011-07-26 16:49:47 -07:00
2011-03-31 11:26:23 -03:00
2011-07-25 20:57:14 -07:00
2009-06-18 13:04:05 -07:00
2010-05-25 08:07:06 -07:00
2010-04-06 15:52:11 -07:00
2010-08-09 20:45:05 -07:00
2011-08-03 11:30:42 -04:00
2010-11-22 13:25:13 +10:00
2011-07-25 20:57:16 -07:00
2011-07-25 20:57:15 -07:00
2011-08-06 18:32:45 -07:00
2011-11-11 09:44:43 -08:00
2011-03-31 11:26:23 -03:00
2010-06-16 18:08:13 +02:00
2010-01-11 09:34:05 -08:00
2008-07-26 12:00:10 -07:00
2011-03-31 11:26:23 -03:00
2010-05-19 22:40:47 -04:00
2011-07-25 21:00:19 -07:00