From patchwork Mon Jul 4 10:03:31 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paolo Pisati X-Patchwork-Id: 103071 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id 35EBCB6F6F for ; Mon, 4 Jul 2011 20:03:50 +1000 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1Qdg0B-0005oW-Kz; Mon, 04 Jul 2011 10:03:39 +0000 Received: from adelie.canonical.com ([91.189.90.139]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1Qdg09-0005o2-Fm for kernel-team@lists.ubuntu.com; Mon, 04 Jul 2011 10:03:37 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by adelie.canonical.com with esmtp (Exim 4.71 #1 (Debian)) id 1Qdg09-0007pV-Am for ; Mon, 04 Jul 2011 10:03:37 +0000 Received: from dynamic-adsl-94-36-146-179.clienti.tiscali.it ([94.36.146.179] helo=canonical.com) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1Qdg09-00056K-1x for kernel-team@lists.ubuntu.com; Mon, 04 Jul 2011 10:03:37 +0000 From: paolo.pisati@canonical.com To: kernel-team@lists.ubuntu.com Subject: [PATCH 1/4] [PATCH] net: Limit socket I/O iovec total length to INT_MAX - CVE-2010-3859 Date: Mon, 4 Jul 2011 11:03:31 +0100 Message-Id: <1309773814-2669-2-git-send-email-paolo.pisati@canonical.com> X-Mailer: git-send-email 1.7.4.1 In-Reply-To: <1309773814-2669-1-git-send-email-paolo.pisati@canonical.com> References: <1309773814-2669-1-git-send-email-paolo.pisati@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com From: Paolo Pisati BugLink: http://bugs.launchpad.net/bugs/708839 commit 8acfe468b0384e834a303f08ebc4953d72fb690a upstream. This helps protect us from overflow issues down in the individual protocol sendmsg/recvmsg handlers. Once we hit INT_MAX we truncate out the rest of the iovec by setting the iov_len members to zero. This works because: 1) For SOCK_STREAM and SOCK_SEQPACKET sockets, partial writes are allowed and the application will just continue with another write to send the rest of the data. 2) For datagram oriented sockets, where there must be a one-to-one correspondance between write() calls and packets on the wire, INT_MAX is going to be far larger than the packet size limit the protocol is going to check for and signal with -EMSGSIZE. Based upon a patch by Linus Torvalds. CVE-2010-3859 Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Signed-off-by: Stefan Bader Signed-off-by: Brad Figg Signed-off-by: Paolo Pisati --- net/compat.c | 10 ++++++---- net/core/iovec.c | 15 +++++++-------- 2 files changed, 13 insertions(+), 12 deletions(-) diff --git a/net/compat.c b/net/compat.c index 8d73905..2a2659b 100644 --- a/net/compat.c +++ b/net/compat.c @@ -40,10 +40,12 @@ static inline int iov_from_user_compat_to_kern(struct iovec *kiov, compat_size_t len; if (get_user(len, &uiov32->iov_len) || - get_user(buf, &uiov32->iov_base)) { - tot_len = -EFAULT; - break; - } + get_user(buf, &uiov32->iov_base)) + return -EFAULT; + + if (len > INT_MAX - tot_len) + len = INT_MAX - tot_len; + tot_len += len; kiov->iov_base = compat_ptr(buf); kiov->iov_len = (__kernel_size_t) len; diff --git a/net/core/iovec.c b/net/core/iovec.c index 16ad45d..b6a4780 100644 --- a/net/core/iovec.c +++ b/net/core/iovec.c @@ -60,14 +60,13 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address, err = 0; for (ct = 0; ct < m->msg_iovlen; ct++) { - err += iov[ct].iov_len; - /* - * Goal is not to verify user data, but to prevent returning - * negative value, which is interpreted as errno. - * Overflow is still possible, but it is harmless. - */ - if (err < 0) - return -EMSGSIZE; + size_t len = iov[ct].iov_len; + + if (len > INT_MAX - err) { + len = INT_MAX - err; + iov[ct].iov_len = len; + } + err += len; } return err;