[NET]: Fix CMSG validation checks wrt. signedness.

ChangeSet 1.2158, 2004/12/08 12:49:21-08:00, herbert@gondor.apana.org.au

	[NET]: Fix CMSG validation checks wrt. signedness.
	
	Noticed by Georgi Guninski.
	
	Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
	Signed-off-by: David S. Miller <davem@davemloft.net>



 include/linux/socket.h |    4 ++++
 net/core/scm.c         |    4 +---
 net/ipv4/ip_sockglue.c |    5 +----
 net/ipv6/datagram.c    |    4 +---
 net/sctp/socket.c      |    6 +-----
 5 files changed, 8 insertions(+), 15 deletions(-)


diff -Nru a/include/linux/socket.h b/include/linux/socket.h
--- a/include/linux/socket.h	2004-12-08 16:09:01 -08:00
+++ b/include/linux/socket.h	2004-12-08 16:09:01 -08:00
@@ -90,6 +90,10 @@
 				  (struct cmsghdr *)(ctl) : \
 				  (struct cmsghdr *)NULL)
 #define CMSG_FIRSTHDR(msg)	__CMSG_FIRSTHDR((msg)->msg_control,
(msg)->msg_controllen)
+#define CMSG_OK(mhdr, cmsg) ((cmsg)->cmsg_len >= sizeof(struct cmsghdr) && \
+			     (cmsg)->cmsg_len <= (unsigned long) \
+			     ((mhdr)->msg_controllen - \
+			      ((char *)(cmsg) - (char *)(mhdr)->msg_control)))
 
 /*
  *	This mess will go away with glibc
diff -Nru a/net/core/scm.c b/net/core/scm.c
--- a/net/core/scm.c	2004-12-08 16:09:01 -08:00
+++ b/net/core/scm.c	2004-12-08 16:09:01 -08:00
@@ -127,9 +127,7 @@
 		   for too short ancillary data object at all! Oops.
 		   OK, let's add it...
 		 */
-		if (cmsg->cmsg_len < sizeof(struct cmsghdr) ||
-		    (unsigned long)(((char*)cmsg - (char*)msg->msg_control)
-				    + cmsg->cmsg_len) > msg->msg_controllen)
+		if (!CMSG_OK(msg, cmsg))
 			goto error;
 
 		if (cmsg->cmsg_level != SOL_SOCKET)
diff -Nru a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
--- a/net/ipv4/ip_sockglue.c	2004-12-08 16:09:01 -08:00
+++ b/net/ipv4/ip_sockglue.c	2004-12-08 16:09:01 -08:00
@@ -146,11 +146,8 @@
 	struct cmsghdr *cmsg;
 
 	for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) {
-		if (cmsg->cmsg_len < sizeof(struct cmsghdr) ||
-		    (unsigned long)(((char*)cmsg - (char*)msg->msg_control)
-				    + cmsg->cmsg_len) > msg->msg_controllen) {
+		if (!CMSG_OK(msg, cmsg))
 			return -EINVAL;
-		}
 		if (cmsg->cmsg_level != SOL_IP)
 			continue;
 		switch (cmsg->cmsg_type) {
diff -Nru a/net/ipv6/datagram.c b/net/ipv6/datagram.c
--- a/net/ipv6/datagram.c	2004-12-08 16:09:01 -08:00
+++ b/net/ipv6/datagram.c	2004-12-08 16:09:01 -08:00
@@ -427,9 +427,7 @@
 		int addr_type;
 		struct net_device *dev = NULL;
 
-		if (cmsg->cmsg_len < sizeof(struct cmsghdr) ||
-		    (unsigned long)(((char*)cmsg - (char*)msg->msg_control)
-				    + cmsg->cmsg_len) > msg->msg_controllen) {
+		if (!CMSG_OK(msg, cmsg)) {
 			err = -EINVAL;
 			goto exit_f;
 		}
diff -Nru a/net/sctp/socket.c b/net/sctp/socket.c
--- a/net/sctp/socket.c	2004-12-08 16:09:01 -08:00
+++ b/net/sctp/socket.c	2004-12-08 16:09:01 -08:00
@@ -4098,12 +4098,8 @@
 	for (cmsg = CMSG_FIRSTHDR(msg);
 	     cmsg != NULL;
 	     cmsg = CMSG_NXTHDR((struct msghdr*)msg, cmsg)) {
-		/* Check for minimum length.  The SCM code has this check.  */
-		if (cmsg->cmsg_len < sizeof(struct cmsghdr) ||
-		    (unsigned long)(((char*)cmsg - (char*)msg->msg_control)
-				    + cmsg->cmsg_len) > msg->msg_controllen) {
+		if (!CMSG_OK(msg, cmsg))
 			return -EINVAL;
-		}
 
 		/* Should we parse this header or ignore?  */
 		if (cmsg->cmsg_level != IPPROTO_SCTP)