summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorJiri Benc <jbenc@redhat.com>2013-11-07 22:59:19 +0400
committerDavid S. Miller <davem@davemloft.net>2013-11-09 00:12:11 +0400
commitcdbe7c2d6d485459801838c244c409b938e32df5 (patch)
treeadaff9745719732f3ff93abae3f52fa94b80db18 /net
parent13eb2ab2d33c57ebddc57437a7d341995fc9138c (diff)
downloadlinux-cdbe7c2d6d485459801838c244c409b938e32df5.tar.xz
nfnetlink: do not ack malformed messages
Commit 0628b123c96d ("netfilter: nfnetlink: add batch support and use it from nf_tables") introduced a bug leading to various crashes in netlink_ack when netlink message with invalid nlmsg_len was sent by an unprivileged user. Signed-off-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/netfilter/nfnetlink.c8
1 files changed, 5 insertions, 3 deletions
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 027f16af51a0..046aa13b4fea 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -363,13 +363,15 @@ static void nfnetlink_rcv(struct sk_buff *skb)
struct net *net = sock_net(skb->sk);
int msglen;
- if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
- return netlink_ack(skb, nlh, -EPERM);
-
if (nlh->nlmsg_len < NLMSG_HDRLEN ||
skb->len < nlh->nlmsg_len)
return;
+ if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) {
+ netlink_ack(skb, nlh, -EPERM);
+ return;
+ }
+
if (nlh->nlmsg_type == NFNL_MSG_BATCH_BEGIN) {
struct nfgenmsg *nfgenmsg;