Security fix:

- allow raw sockets only with CAP_NET_RAW.
- clear skbuff data before writing CAN frame to it in order to avoid passing
  random bytes to user space.

git-svn-id: svn://svn.berlios.de//socketcan/trunk@10 030b6a49-0b11-0410-94ab-b0dab22257f2

diff --git a/kernel/2.4/can/af_can.c b/kernel/2.4/can/af_can.c
index be8be526a9ef8b12c6fbdf92202b332c87b33803..018be36b28cde5ae345b49cc6103f13dc9ea5387 100644 (file)
--- a/kernel/2.4/can/af_can.c
+++ b/kernel/2.4/can/af_can.c
@@ -282,6 +282,8 @@ static int can_create(struct socket *sock, int protocol)
     case SOCK_RAW:
        switch (protocol) {
        case CAN_RAW:
+           if (!capable(CAP_NET_RAW))
+               return -EPERM;
            break;
        default:
            return -EPROTONOSUPPORT;

diff --git a/kernel/2.4/drivers/sja1000/sja1000.c b/kernel/2.4/drivers/sja1000/sja1000.c
index fc2d65de4281934bae0be3570e53ae7165da2b59..50b66a6e61d24a68d5b7ab47aa48ae08f320a114 100644 (file)
--- a/kernel/2.4/drivers/sja1000/sja1000.c
+++ b/kernel/2.4/drivers/sja1000/sja1000.c
@@ -551,6 +551,7 @@ static void can_rx(struct net_device *dev)
                id |= CAN_RTR_FLAG;
 
        cf = (struct can_frame*)skb_put(skb, sizeof(struct can_frame));
+       memset(cf, 0, sizeof(struct can_frame));
        cf->can_id    = id;
        cf->can_dlc   = dlc;
        for (i = 0; i < dlc; i++) {

diff --git a/kernel/2.6/drivers/net/can/sja1000/sja1000.c b/kernel/2.6/drivers/net/can/sja1000/sja1000.c
index 319682753e43fb9b314b0eb36757cd1436b4b721..c9645e595b141c39393ed46394c47d7237d11cd9 100644 (file)
--- a/kernel/2.6/drivers/net/can/sja1000/sja1000.c
+++ b/kernel/2.6/drivers/net/can/sja1000/sja1000.c
@@ -551,6 +551,7 @@ static void can_rx(struct net_device *dev)
                id |= CAN_RTR_FLAG;
 
        cf = (struct can_frame*)skb_put(skb, sizeof(struct can_frame));
+       memset(cf, 0, sizeof(struct can_frame));
        cf->can_id    = id;
        cf->can_dlc   = dlc;
        for (i = 0; i < dlc; i++) {

diff --git a/kernel/2.6/net/can/af_can.c b/kernel/2.6/net/can/af_can.c
index 67a910278b01b805b01d6b60e686656061a06f01..29c36f4c12c257690ed397da113f7e06ae26f8b9 100644 (file)
--- a/kernel/2.6/net/can/af_can.c
+++ b/kernel/2.6/net/can/af_can.c
@@ -304,6 +304,8 @@ static int can_create(struct socket *sock, int protocol)
     case SOCK_RAW:
        switch (protocol) {
        case CAN_RAW:
+           if (!capable(CAP_NET_RAW))
+               return -EPERM;
            break;
        default:
            return -EPROTONOSUPPORT;