Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 85fbaa75037d0b6b786ff18658ddf0b4014ce2a4

Authored by Hannes Frederic Sowa
Committed by David S. Miller
1 parent ca15a078bd
Exists in smarc-imx_3.14.28_1.0.0_ga and in 1 other branch imx_3.14.28_1.0.0_ga

inet: fix addr_len/msg->msg_namelen assignment in recv_error and rxpmtu functions 

Commit bceaa90240b6019ed73b49965eac7d167610be69 ("inet: prevent leakage
of uninitialized memory to user in recv syscalls") conditionally updated
addr_len if the msg_name is written to. The recv_error and rxpmtu
functions relied on the recvmsg functions to set up addr_len before.

As this does not happen any more we have to pass addr_len to those
functions as well and set it to the size of the corresponding sockaddr
length.

This broke traceroute and such.

Fixes: bceaa90240b6 ("inet: prevent leakage of uninitialized memory to user in recv syscalls")
Reported-by: Brad Spengler <spender@grsecurity.net>
Reported-by: Tom Labanowski
Cc: mpb <mpb.mail@gmail.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 12 changed files with 26 additions and 17 deletions Side-by-side Diff

... ... @@ -473,7 +473,7 @@
473 473 int ip_ra_control(struct sock *sk, unsigned char on,
474 474 void (*destructor)(struct sock *));
475 475  
476   -int ip_recv_error(struct sock *sk, struct msghdr *msg, int len);
  476 +int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len);
477 477 void ip_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port,
478 478 u32 info, u8 *payload);
479 479 void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 dport,
... ... @@ -776,8 +776,10 @@
776 776  
777 777 int ip6_datagram_connect(struct sock *sk, struct sockaddr *addr, int addr_len);
778 778  
779   -int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len);
780   -int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len);
  779 +int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len,
  780 + int *addr_len);
  781 +int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len,
  782 + int *addr_len);
781 783 void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port,
782 784 u32 info, u8 *payload);
783 785 void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info);
... ... @@ -31,7 +31,8 @@
31 31  
32 32 /* Compatibility glue so we can support IPv6 when it's compiled as a module */
33 33 struct pingv6_ops {
34   - int (*ipv6_recv_error)(struct sock *sk, struct msghdr *msg, int len);
  34 + int (*ipv6_recv_error)(struct sock *sk, struct msghdr *msg, int len,
  35 + int *addr_len);
35 36 int (*ip6_datagram_recv_ctl)(struct sock *sk, struct msghdr *msg,
36 37 struct sk_buff *skb);
37 38 int (*icmpv6_err_convert)(u8 type, u8 code, int *err);
net/ipv4/ip_sockglue.c
Diff comments   View file @ 85fbaa7
... ... @@ -386,7 +386,7 @@
386 386 /*
387 387 * Handle MSG_ERRQUEUE
388 388 */
389   -int ip_recv_error(struct sock *sk, struct msghdr *msg, int len)
  389 +int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
390 390 {
391 391 struct sock_exterr_skb *serr;
392 392 struct sk_buff *skb, *skb2;
... ... @@ -423,6 +423,7 @@
423 423 serr->addr_offset);
424 424 sin->sin_port = serr->port;
425 425 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
  426 + *addr_len = sizeof(*sin);
426 427 }
427 428  
428 429 memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
... ... @@ -841,10 +841,11 @@
841 841  
842 842 if (flags & MSG_ERRQUEUE) {
843 843 if (family == AF_INET) {
844   - return ip_recv_error(sk, msg, len);
  844 + return ip_recv_error(sk, msg, len, addr_len);
845 845 #if IS_ENABLED(CONFIG_IPV6)
846 846 } else if (family == AF_INET6) {
847   - return pingv6_ops.ipv6_recv_error(sk, msg, len);
  847 + return pingv6_ops.ipv6_recv_error(sk, msg, len,
  848 + addr_len);
848 849 #endif
849 850 }
850 851 }
... ... @@ -697,7 +697,7 @@
697 697 goto out;
698 698  
699 699 if (flags & MSG_ERRQUEUE) {
700   - err = ip_recv_error(sk, msg, len);
  700 + err = ip_recv_error(sk, msg, len, addr_len);
701 701 goto out;
702 702 }
703 703  
... ... @@ -1236,7 +1236,7 @@
1236 1236 bool slow;
1237 1237  
1238 1238 if (flags & MSG_ERRQUEUE)
1239   - return ip_recv_error(sk, msg, len);
  1239 + return ip_recv_error(sk, msg, len, addr_len);
1240 1240  
1241 1241 try_again:
1242 1242 skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
... ... @@ -318,7 +318,7 @@
318 318 /*
319 319 * Handle MSG_ERRQUEUE
320 320 */
321   -int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
  321 +int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
322 322 {
323 323 struct ipv6_pinfo *np = inet6_sk(sk);
324 324 struct sock_exterr_skb *serr;
... ... @@ -369,6 +369,7 @@
369 369 &sin->sin6_addr);
370 370 sin->sin6_scope_id = 0;
371 371 }
  372 + *addr_len = sizeof(*sin);
372 373 }
373 374  
374 375 memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
... ... @@ -423,7 +424,8 @@
423 424 /*
424 425 * Handle IPV6_RECVPATHMTU
425 426 */
426   -int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len)
  427 +int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len,
  428 + int *addr_len)
427 429 {
428 430 struct ipv6_pinfo *np = inet6_sk(sk);
429 431 struct sk_buff *skb;
... ... @@ -457,6 +459,7 @@
457 459 sin->sin6_port = 0;
458 460 sin->sin6_scope_id = mtu_info.ip6m_addr.sin6_scope_id;
459 461 sin->sin6_addr = mtu_info.ip6m_addr.sin6_addr;
  462 + *addr_len = sizeof(*sin);
460 463 }
461 464  
462 465 put_cmsg(msg, SOL_IPV6, IPV6_PATHMTU, sizeof(mtu_info), &mtu_info);
... ... @@ -57,7 +57,8 @@
57 57  
58 58  
59 59 /* Compatibility glue so we can support IPv6 when it's compiled as a module */
60   -static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
  60 +static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len,
  61 + int *addr_len)
61 62 {
62 63 return -EAFNOSUPPORT;
63 64 }
... ... @@ -466,10 +466,10 @@
466 466 return -EOPNOTSUPP;
467 467  
468 468 if (flags & MSG_ERRQUEUE)
469   - return ipv6_recv_error(sk, msg, len);
  469 + return ipv6_recv_error(sk, msg, len, addr_len);
470 470  
471 471 if (np->rxpmtu && np->rxopt.bits.rxpmtu)
472   - return ipv6_recv_rxpmtu(sk, msg, len);
  472 + return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
473 473  
474 474 skb = skb_recv_datagram(sk, flags, noblock, &err);
475 475 if (!skb)
... ... @@ -393,10 +393,10 @@
393 393 bool slow;
394 394  
395 395 if (flags & MSG_ERRQUEUE)
396   - return ipv6_recv_error(sk, msg, len);
  396 + return ipv6_recv_error(sk, msg, len, addr_len);
397 397  
398 398 if (np->rxpmtu && np->rxopt.bits.rxpmtu)
399   - return ipv6_recv_rxpmtu(sk, msg, len);
  399 + return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
400 400  
401 401 try_again:
402 402 skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
... ... @@ -665,7 +665,7 @@
665 665 *addr_len = sizeof(*lsa);
666 666  
667 667 if (flags & MSG_ERRQUEUE)
668   - return ipv6_recv_error(sk, msg, len);
  668 + return ipv6_recv_error(sk, msg, len, addr_len);
669 669  
670 670 skb = skb_recv_datagram(sk, flags, noblock, &err);
671 671 if (!skb)