diff mbox

[1/1] net: clamp ->msg_namelen instead of returning an error

Message ID 1389733328-16988-2-git-send-email-apw@canonical.com
State New
Headers show

Commit Message

Andy Whitcroft Jan. 14, 2014, 9:02 p.m. UTC 
From: Dan Carpenter <dan.carpenter@oracle.com>

If kmsg->msg_namelen > sizeof(struct sockaddr_storage) then in the
original code that would lead to memory corruption in the kernel if you
had audit configured.  If you didn't have audit configured it was
harmless.

There are some programs such as beta versions of Ruby which use too
large of a buffer and returning an error code breaks them.  We should
clamp the ->msg_namelen value instead.

Fixes: 1661bf364ae9 ("net: heap overflow in __audit_sockaddr()")
Reported-by: Eric Wong <normalperson@yhbt.net>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Tested-by: Eric Wong <normalperson@yhbt.net>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

(cherry picked from commit db31c55a6fb245fdbb752a2ca4aefec89afabb06)
BugLink: http://bugs.launchpad.net/bugs/1269053
Signed-off-by: Andy Whitcroft <apw@canonical.com>
---
 net/compat.c | 2 +-
 net/socket.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

Comments

Stefan Bader Jan. 15, 2014, 8:41 a.m. UTC | #1 
Looks reasonable enough and has good testing.
diff mbox

Patch

diff --git a/net/compat.c b/net/compat.c
index 8903258..09c3d84 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -72,7 +72,7 @@  int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
 	    __get_user(kmsg->msg_flags, &umsg->msg_flags))
 		return -EFAULT;
 	if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
-		return -EINVAL;
+		kmsg->msg_namelen = sizeof(struct sockaddr_storage);
 	kmsg->msg_name = compat_ptr(tmp1);
 	kmsg->msg_iov = compat_ptr(tmp2);
 	kmsg->msg_control = compat_ptr(tmp3);
diff --git a/net/socket.c b/net/socket.c
index 4b94643..d64bfbf 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1979,7 +1979,7 @@  static int copy_msghdr_from_user(struct msghdr *kmsg,
 	if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
 		return -EFAULT;
 	if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
-		return -EINVAL;
+		kmsg->msg_namelen = sizeof(struct sockaddr_storage);
 	return 0;
 }