All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Florian Westphal <fw@strlen.de>,
	Hannes Frederic Sowa <hannes@stressinduktion.org>,
	"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 3.4 17/27] net: rose: restore old recvmsg behavior
Date: Mon, 13 Jan 2014 16:26:31 -0800	[thread overview]
Message-ID: <20140114002623.867006270@linuxfoundation.org> (raw)
In-Reply-To: <20140114002623.356220317@linuxfoundation.org>

3.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Florian Westphal <fw@strlen.de>

[ Upstream commit f81152e35001e91997ec74a7b4e040e6ab0acccf ]

recvmsg handler in net/rose/af_rose.c performs size-check ->msg_namelen.

After commit f3d3342602f8bcbf37d7c46641cb9bca7618eb1c
(net: rework recvmsg handler msg_name and msg_namelen logic), we now
always take the else branch due to namelen being initialized to 0.

Digging in netdev-vger-cvs git repo shows that msg_namelen was
initialized with a fixed-size since at least 1995, so the else branch
was never taken.

Compile tested only.

Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/rose/af_rose.c |   16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1257,6 +1257,7 @@ static int rose_recvmsg(struct kiocb *io
 
 	if (msg->msg_name) {
 		struct sockaddr_rose *srose;
+		struct full_sockaddr_rose *full_srose = msg->msg_name;
 
 		memset(msg->msg_name, 0, sizeof(struct full_sockaddr_rose));
 		srose = msg->msg_name;
@@ -1264,18 +1265,9 @@ static int rose_recvmsg(struct kiocb *io
 		srose->srose_addr   = rose->dest_addr;
 		srose->srose_call   = rose->dest_call;
 		srose->srose_ndigis = rose->dest_ndigis;
-		if (msg->msg_namelen >= sizeof(struct full_sockaddr_rose)) {
-			struct full_sockaddr_rose *full_srose = (struct full_sockaddr_rose *)msg->msg_name;
-			for (n = 0 ; n < rose->dest_ndigis ; n++)
-				full_srose->srose_digis[n] = rose->dest_digis[n];
-			msg->msg_namelen = sizeof(struct full_sockaddr_rose);
-		} else {
-			if (rose->dest_ndigis >= 1) {
-				srose->srose_ndigis = 1;
-				srose->srose_digi = rose->dest_digis[0];
-			}
-			msg->msg_namelen = sizeof(struct sockaddr_rose);
-		}
+		for (n = 0 ; n < rose->dest_ndigis ; n++)
+			full_srose->srose_digis[n] = rose->dest_digis[n];
+		msg->msg_namelen = sizeof(struct full_sockaddr_rose);
 	}
 
 	skb_free_datagram(sk, skb);



  parent reply	other threads:[~2014-01-14  0:26 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-01-14  0:26 [PATCH 3.4 00/27] 3.4.77-stable review Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 01/27] net: do not pretend FRAGLIST support Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 02/27] rds: prevent BUG_ON triggered on congestion update to loopback Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 03/27] macvtap: Do not double-count received packets Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 04/27] macvtap: update file current position Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 05/27] tun: " Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 06/27] macvtap: signal truncated packets Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 07/27] ipv6: dont count addrconf generated routes against gc limit Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 08/27] net: drop_monitor: fix the value of maxattr Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 09/27] net: unix: allow set_peek_off to fail Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 10/27] tg3: Initialize REG_BASE_ADDR at PCI config offset 120 to 0 Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 11/27] netvsc: dont flush peers notifying work during setting mtu Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 12/27] net: unix: allow bind to fail on mutex lock Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 13/27] net: inet_diag: zero out uninitialized idiag_{src,dst} fields Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 14/27] drivers/net/hamradio: Integer overflow in hdlcdrv_ioctl() Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 16/27] rds: prevent dereference of a NULL device Greg Kroah-Hartman
2014-01-14  0:26 ` Greg Kroah-Hartman [this message]
2014-01-14  0:26 ` [PATCH 3.4 18/27] vlan: Fix header ops passthru when doing TX VLAN offload Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 19/27] net: llc: fix use after free in llc_ui_recvmsg Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 20/27] bridge: use spin_lock_bh() in br_multicast_set_hash_max Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 21/27] ARM: fix "bad mode in ... handler" message for undefined instructions Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 22/27] ARM: shmobile: mackerel: Fix coherent DMA mask Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 23/27] x86, fpu, amd: Clear exceptions in AMD FXSAVE workaround Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 24/27] sched: Fix race on toggling cfs_bandwidth_used Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 25/27] sched: Fix cfs_bandwidth misuse of hrtimer_expires_remaining Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 26/27] sched: Fix hrtimer_cancel()/rq->lock deadlock Greg Kroah-Hartman
2014-01-14  0:26 ` [PATCH 3.4 27/27] sched: Guarantee new group-entities always have weight Greg Kroah-Hartman
2014-01-14  2:59 ` [PATCH 3.4 00/27] 3.4.77-stable review Guenter Roeck
2014-01-14  3:03   ` Greg Kroah-Hartman
2014-01-14 19:29 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20140114002623.867006270@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=davem@davemloft.net \
    --cc=fw@strlen.de \
    --cc=hannes@stressinduktion.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.