* [PATCH 1/1] net:socket: set msg_namelen to 0 if msg_name is passed as NULL in msghdr struct from userland.
@ 2014-09-08 21:49 Ani Sinha
2014-09-09 22:14 ` Ani Sinha
2014-09-10 0:36 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Ani Sinha @ 2014-09-08 21:49 UTC (permalink / raw)
To: ani, fruggeri, davem, netdev, fenner, travisb, hannes,
matthew.leach, eric.dumazet
Linux manpage for recvmsg and sendmsg calls does not explicitly mention setting msg_namelen to 0 when
msg_name passed set as NULL. When developers don't set msg_namelen member in msghdr, it might contain garbage
value which will fail the validation check and sendmsg and recvmsg calls from kernel will return EINVAL. This will
break old binaries and any code for which there is no access to source code.
To fix this, we set msg_namelen to 0 when msg_name is passed as NULL from userland.
Signed-off-by: Ani Sinha <ani@arista.com>
---
net/socket.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/net/socket.c b/net/socket.c
index 95ee7d8..457be6a 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1997,6 +1997,9 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,
if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
return -EFAULT;
+ if (kmsg->msg_name == NULL)
+ kmsg->msg_namelen = 0;
+
if (kmsg->msg_namelen < 0)
return -EINVAL;
--
1.7.4.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1] net:socket: set msg_namelen to 0 if msg_name is passed as NULL in msghdr struct from userland.
2014-09-08 21:49 [PATCH 1/1] net:socket: set msg_namelen to 0 if msg_name is passed as NULL in msghdr struct from userland Ani Sinha
@ 2014-09-09 22:14 ` Ani Sinha
2014-09-10 0:36 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Ani Sinha @ 2014-09-09 22:14 UTC (permalink / raw)
To: Ani Sinha, fruggeri, David Miller, netdev, fenner, travisb,
Hannes Frederic Sowa, matthew.leach, Eric Dumazet
Any feedback on this patch? Any concerns?
On Mon, Sep 8, 2014 at 2:49 PM, Ani Sinha <ani@arista.com> wrote:
> Linux manpage for recvmsg and sendmsg calls does not explicitly mention setting msg_namelen to 0 when
> msg_name passed set as NULL. When developers don't set msg_namelen member in msghdr, it might contain garbage
> value which will fail the validation check and sendmsg and recvmsg calls from kernel will return EINVAL. This will
> break old binaries and any code for which there is no access to source code.
> To fix this, we set msg_namelen to 0 when msg_name is passed as NULL from userland.
>
> Signed-off-by: Ani Sinha <ani@arista.com>
> ---
> net/socket.c | 3 +++
> 1 files changed, 3 insertions(+), 0 deletions(-)
>
> diff --git a/net/socket.c b/net/socket.c
> index 95ee7d8..457be6a 100644
> --- a/net/socket.c
> +++ b/net/socket.c
> @@ -1997,6 +1997,9 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,
> if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
> return -EFAULT;
>
> + if (kmsg->msg_name == NULL)
> + kmsg->msg_namelen = 0;
> +
> if (kmsg->msg_namelen < 0)
> return -EINVAL;
>
> --
> 1.7.4.4
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1] net:socket: set msg_namelen to 0 if msg_name is passed as NULL in msghdr struct from userland.
2014-09-08 21:49 [PATCH 1/1] net:socket: set msg_namelen to 0 if msg_name is passed as NULL in msghdr struct from userland Ani Sinha
2014-09-09 22:14 ` Ani Sinha
@ 2014-09-10 0:36 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2014-09-10 0:36 UTC (permalink / raw)
To: ani; +Cc: fruggeri, netdev, fenner, travisb, hannes, matthew.leach,
eric.dumazet
From: Ani Sinha <ani@arista.com>
Date: Mon, 8 Sep 2014 14:49:59 -0700
> Linux manpage for recvmsg and sendmsg calls does not explicitly mention setting msg_namelen to 0 when
> msg_name passed set as NULL. When developers don't set msg_namelen member in msghdr, it might contain garbage
> value which will fail the validation check and sendmsg and recvmsg calls from kernel will return EINVAL. This will
> break old binaries and any code for which there is no access to source code.
> To fix this, we set msg_namelen to 0 when msg_name is passed as NULL from userland.
>
> Signed-off-by: Ani Sinha <ani@arista.com>
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2014-09-10 0:36 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-09-08 21:49 [PATCH 1/1] net:socket: set msg_namelen to 0 if msg_name is passed as NULL in msghdr struct from userland Ani Sinha
2014-09-09 22:14 ` Ani Sinha
2014-09-10 0:36 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).