On Mon, 17 Nov 2003 12:11:52 +0200 (EET)
Ville Nuorvala <vnuorval@xxxxxxxxxx> wrote:
> I noticed some erratic behavior when doing "ip -6 r". I traced the problem
> to rt6_dump_route() where we typecast NLMSG_DATA() to a rtmsg without
> checking the size of the netlink message first. Seems like ip only passes
> a rtgenmsg to the kernel when it does a dump, so we end up reading pure
> garbage when we interpret it as a rtmsg. Please apply the patch!
Let's discuss this a little bit. :)
I believed that these lengths are supposed to be verified at one level
higher, in net/core/rtnetlink.c, see "rtm_min[]".
Well, it doesn't do this length verification on dumps.
I can only assume this is intentional. Ok, I see, cases
like ipv4 check the length properly so it is clear that
this is required.
I will apply your patch.
|