From: Philippe Troin <phil@fifi.org>
To: "David S. Miller" <davem@redhat.com>
Cc: linux-kernel@vger.kernel.org, alan@lxorguk.ukuu.org.uk
Subject: Re: 2.2.x BUG & PATCH: recvmsg() does not check msg_controllen correctly
Date: 03 Nov 2000 16:17:53 -0800 [thread overview]
Message-ID: <878zr0vbda.fsf@tantale.fifi.org> (raw)
In-Reply-To: <87n1fgvl7a.fsf@tantale.fifi.org> <200011032218.OAA12790@pizda.ninka.net>
In-Reply-To: <200011032218.OAA12790@pizda.ninka.net> ("David S. Miller"'s message of "Fri, 3 Nov 2000 14:18:35 -0800")
"David S. Miller" <davem@redhat.com> writes:
> The real bug is in the setting of MSG_TRUNC (which is the only side
> effect of your change). So the better fix is:
>
> --- net/core/scm.c.~1~ Tue Jun 15 09:19:30 1999
> +++ net/core/scm.c Fri Nov 3 14:18:06 2000
> @@ -251,7 +251,7 @@
> msg->msg_controllen -= cmlen;
> }
> }
> - if (i < fdnum)
> + if (i < fdnum || (fdnum && fdmax <= 0))
> msg->msg_flags |= MSG_CTRUNC;
>
> /*
Mmmh, no, if fdmax <= 0 (which happens when msg_controllen <
sizeof(struct cmsghdr)), then alls fds are passed, eventually
clobbering past ((char*)(msg_control)+m_controllen).
Run the little test case if you're not convinced...
I stand by my patch :-)
Phil.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/
next prev parent reply other threads:[~2000-11-04 0:18 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2000-11-03 20:45 2.2.x BUG & PATCH: recvmsg() does not check msg_controllen correctly Philippe Troin
2000-11-03 22:18 ` David S. Miller
2000-11-04 0:17 ` Philippe Troin [this message]
2000-11-04 0:38 ` David S. Miller
2000-11-04 3:53 ` Philippe Troin
2000-11-04 4:51 ` David S. Miller
2000-11-05 2:40 ` Philippe Troin
2000-11-06 3:32 ` David S. Miller
2000-11-06 4:07 ` Philippe Troin
2000-11-06 3:57 ` David S. Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=878zr0vbda.fsf@tantale.fifi.org \
--to=phil@fifi.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=davem@redhat.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox