From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.0 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS, T_DKIMWL_WL_HIGH,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0C4BEC43219 for ; Sat, 4 May 2019 10:30:43 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D2729206BB for ; Sat, 4 May 2019 10:30:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1556965842; bh=Vv78MCYlMzXzeEeW82FVaznn6iZtpHm1IduvsM971Yo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=JRS5GJ/5/o9sQA13hzQuueGajyKacnBl2T0Hcq6gD/W6YxnI4X1LLuRiOIqQUPTcr xkrSVsEVgtkfK8Bww/2xs7K7OJuty15bpI/e7BAFIVEGAd3elqeWbTXkD0bSfGe7Tb GOtmm0/3wrUrSMbqxEcCz4/qYu319K4v8f/Yut5Q= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727568AbfEDKal (ORCPT ); Sat, 4 May 2019 06:30:41 -0400 Received: from mail.kernel.org ([198.145.29.99]:35148 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727425AbfEDKZv (ORCPT ); Sat, 4 May 2019 06:25:51 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 8EC9A2084A; Sat, 4 May 2019 10:25:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1556965551; bh=Vv78MCYlMzXzeEeW82FVaznn6iZtpHm1IduvsM971Yo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=suqbmFAqoY7N+1P2ysK41Hd21jjw4Bl41SB2JMFanGILoUI22LLLMpPefzfoCV6We tYds6ZiXNmnejuw+YUrIOvZi+FvDxO90T/FtcSVo0mHan4NMl4Jgk95nj76UwSXKnH W0hJDtWm/qZTXgfeqnifmsu9uGUbdGkVXPxHjVoc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Laight , Willem de Bruijn , "David S. Miller" Subject: [PATCH 5.0 15/32] packet: in recvmsg msg_name return at least sizeof sockaddr_ll Date: Sat, 4 May 2019 12:25:00 +0200 Message-Id: <20190504102452.993434188@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190504102452.523724210@linuxfoundation.org> References: <20190504102452.523724210@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Willem de Bruijn [ Upstream commit b2cf86e1563e33a14a1c69b3e508d15dc12f804c ] Packet send checks that msg_name is at least sizeof sockaddr_ll. Packet recv must return at least this length, so that its output can be passed unmodified to packet send. This ceased to be true since adding support for lladdr longer than sll_addr. Since, the return value uses true address length. Always return at least sizeof sockaddr_ll, even if address length is shorter. Zero the padding bytes. Change v1->v2: do not overwrite zeroed padding again. use copy_len. Fixes: 0fb375fb9b93 ("[AF_PACKET]: Allow for > 8 byte hardware addresses.") Suggested-by: David Laight Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/packet/af_packet.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -3349,20 +3349,29 @@ static int packet_recvmsg(struct socket sock_recv_ts_and_drops(msg, sk, skb); if (msg->msg_name) { + int copy_len; + /* If the address length field is there to be filled * in, we fill it in now. */ if (sock->type == SOCK_PACKET) { __sockaddr_check_size(sizeof(struct sockaddr_pkt)); msg->msg_namelen = sizeof(struct sockaddr_pkt); + copy_len = msg->msg_namelen; } else { struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll; msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr); + copy_len = msg->msg_namelen; + if (msg->msg_namelen < sizeof(struct sockaddr_ll)) { + memset(msg->msg_name + + offsetof(struct sockaddr_ll, sll_addr), + 0, sizeof(sll->sll_addr)); + msg->msg_namelen = sizeof(struct sockaddr_ll); + } } - memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, - msg->msg_namelen); + memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len); } if (pkt_sk(sk)->auxdata) {