tree 79e40b6e212753eae8b7c468a1d8936d1014aee4
parent f3b41076ff3406a50c558f79e2180759b01c3ec0
author Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> 1484284156 -0700
committer Ariel Yin <ayin@google.com> 1484777767 +0000

net: rmnet_data: Fix incorrect netlink handling

rmnet_data netlink handler currently does not check for the
incoming process pid and instead just loops back the pid.
A malicious root user could potentially send a message with
source pid 0 and this could cause rmnet_data to loop the message
back till an out of memory situation occurs.

rmnet_data also does not check for the message length of the
incoming netlink messages and instead casts the netlink message
without checking for the boundary.

Fix these two scenarios by adding the pid and message length checks
respectively.

Bug: 31252965
CRs-Fixed: 1098801
Change-Id: I172c1a7112e67e82959b397af7ddfd963d819bdc
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>