Skip to content

Commit 7775142

Browse files
marceloleitnerdavem330
authored andcommitted
ipv6: addrconf: validate new MTU before applying it
Currently we don't check if the new MTU is valid or not and this allows one to configure a smaller than minimum allowed by RFCs or even bigger than interface own MTU, which is a problem as it may lead to packet drops. If you have a daemon like NetworkManager running, this may be exploited by remote attackers by forging RA packets with an invalid MTU, possibly leading to a DoS. (NetworkManager currently only validates for values too small, but not for too big ones.) The fix is just to make sure the new value is valid. That is, between IPV6_MIN_MTU and interface's MTU. Note that similar check is already performed at ndisc_router_discovery(), for when kernel itself parses the RA. Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com> Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 8d4ac39 commit 7775142

File tree

1 file changed

+16
-1
lines changed

1 file changed

+16
-1
lines changed

Diff for: net/ipv6/addrconf.c

+16-1
Original file line numberDiff line numberDiff line change
@@ -4903,6 +4903,21 @@ int addrconf_sysctl_forward(struct ctl_table *ctl, int write,
49034903
return ret;
49044904
}
49054905

4906+
static
4907+
int addrconf_sysctl_mtu(struct ctl_table *ctl, int write,
4908+
void __user *buffer, size_t *lenp, loff_t *ppos)
4909+
{
4910+
struct inet6_dev *idev = ctl->extra1;
4911+
int min_mtu = IPV6_MIN_MTU;
4912+
struct ctl_table lctl;
4913+
4914+
lctl = *ctl;
4915+
lctl.extra1 = &min_mtu;
4916+
lctl.extra2 = idev ? &idev->dev->mtu : NULL;
4917+
4918+
return proc_dointvec_minmax(&lctl, write, buffer, lenp, ppos);
4919+
}
4920+
49064921
static void dev_disable_change(struct inet6_dev *idev)
49074922
{
49084923
struct netdev_notifier_info info;
@@ -5054,7 +5069,7 @@ static struct addrconf_sysctl_table
50545069
.data = &ipv6_devconf.mtu6,
50555070
.maxlen = sizeof(int),
50565071
.mode = 0644,
5057-
.proc_handler = proc_dointvec,
5072+
.proc_handler = addrconf_sysctl_mtu,
50585073
},
50595074
{
50605075
.procname = "accept_ra",

0 commit comments

Comments
 (0)