Subject: Re: inet_diag insufficient validation?

From: Dan Rosenberg <[email-masked]>
Date: Thu, 02 Jun 2011 20:50:11 -0400

On Wed, 2011-06-01 at 11:40 -0400, Dan Rosenberg wrote:

> Finally, I can't seem to find any validation that the reported length of
> the netlink message header doesn't exceed the skb length, as checked in
> some other netlink receive functions, which could result in reading
> beyond the bounds of the socket data.  I could just be missing something
> here though.
> 

And for the second time, I was missing something - this validation
happens in netlink_rcv_skb().

That leaves the infinite loop in bytecode auditing, which I've confirmed
via reproducer.

-Dan