android/android_kernel_asus_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

inet: fix addr_len/msg->msg_namelen assignment in recv_error and rxpmtu functions

Browse Source 
Commit bceaa90240 ("inet: prevent leakage
of uninitialized memory to user in recv syscalls") conditionally updated
addr_len if the msg_name is written to. The recv_error and rxpmtu
functions relied on the recvmsg functions to set up addr_len before.

As this does not happen any more we have to pass addr_len to those
functions as well and set it to the size of the corresponding sockaddr
length.

This broke traceroute and such.

Fixes: bceaa90240 ("inet: prevent leakage of uninitialized memory to user in recv syscalls")
Reported-by: Brad Spengler <spender@grsecurity.net>
Reported-by: Tom Labanowski
Cc: mpb <mpb.mail@gmail.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Hannes Frederic Sowa 2013-11-23 00:46:12 +01:00 committed by David S. Miller
parent ca15a078bd
commit 85fbaa7503
12 changed files with 26 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/net/ip.h
View File

@ -473,7 +473,7 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname,
int ip_ra_control(struct sock *sk, unsigned char on, int ip_ra_control(struct sock *sk, unsigned char on,
void (*destructor)(struct sock *)); void (*destructor)(struct sock *));
int ip_recv_error(struct sock *sk, struct msghdr *msg, int len); int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len);
void ip_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port, void ip_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port,
u32 info, u8 *payload); u32 info, u8 *payload);
void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 dport, void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 dport,

6
include/net/ipv6.h
View File

@ -776,8 +776,10 @@ int compat_ipv6_getsockopt(struct sock *sk, int level, int optname,
int ip6_datagram_connect(struct sock *sk, struct sockaddr *addr, int addr_len); int ip6_datagram_connect(struct sock *sk, struct sockaddr *addr, int addr_len);
int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len); int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len,
int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len); int *addr_len);
int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len,
int *addr_len);
void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port, void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port,
u32 info, u8 *payload); u32 info, u8 *payload);
void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info); void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info);

3
include/net/ping.h
View File

@ -31,7 +31,8 @@
/* Compatibility glue so we can support IPv6 when it's compiled as a module */ /* Compatibility glue so we can support IPv6 when it's compiled as a module */
struct pingv6_ops { struct pingv6_ops {
int (*ipv6_recv_error)(struct sock *sk, struct msghdr *msg, int len); int (*ipv6_recv_error)(struct sock *sk, struct msghdr *msg, int len,
int *addr_len);
int (*ip6_datagram_recv_ctl)(struct sock *sk, struct msghdr *msg, int (*ip6_datagram_recv_ctl)(struct sock *sk, struct msghdr *msg,
struct sk_buff *skb); struct sk_buff *skb);
int (*icmpv6_err_convert)(u8 type, u8 code, int *err); int (*icmpv6_err_convert)(u8 type, u8 code, int *err);

3
net/ipv4/ip_sockglue.c
View File

@ -386,7 +386,7 @@ void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 port, u32 inf
/* /*
* Handle MSG_ERRQUEUE * Handle MSG_ERRQUEUE
*/ */
int ip_recv_error(struct sock *sk, struct msghdr *msg, int len) int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
{ {
struct sock_exterr_skb *serr; struct sock_exterr_skb *serr;
struct sk_buff *skb, *skb2; struct sk_buff *skb, *skb2;
@ -423,6 +423,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len)
serr->addr_offset); serr->addr_offset);
sin->sin_port = serr->port; sin->sin_port = serr->port;
memset(&sin->sin_zero, 0, sizeof(sin->sin_zero)); memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
*addr_len = sizeof(*sin);
} }
memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err)); memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));

5
net/ipv4/ping.c
View File

@ -841,10 +841,11 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
if (flags & MSG_ERRQUEUE) { if (flags & MSG_ERRQUEUE) {
if (family == AF_INET) { if (family == AF_INET) {
return ip_recv_error(sk, msg, len); return ip_recv_error(sk, msg, len, addr_len);
#if IS_ENABLED(CONFIG_IPV6) #if IS_ENABLED(CONFIG_IPV6)
} else if (family == AF_INET6) { } else if (family == AF_INET6) {
return pingv6_ops.ipv6_recv_error(sk, msg, len); return pingv6_ops.ipv6_recv_error(sk, msg, len,
addr_len);
#endif #endif
} }
} }

2
net/ipv4/raw.c
View File

@ -697,7 +697,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
goto out; goto out;
if (flags & MSG_ERRQUEUE) { if (flags & MSG_ERRQUEUE) {
err = ip_recv_error(sk, msg, len); err = ip_recv_error(sk, msg, len, addr_len);
goto out; goto out;
} }

2
net/ipv4/udp.c
View File

@ -1236,7 +1236,7 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
bool slow; bool slow;
if (flags & MSG_ERRQUEUE) if (flags & MSG_ERRQUEUE)
return ip_recv_error(sk, msg, len); return ip_recv_error(sk, msg, len, addr_len);
try_again: try_again:
skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0), skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),

7
net/ipv6/datagram.c
View File

@ -318,7 +318,7 @@ void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu)
/* /*
* Handle MSG_ERRQUEUE * Handle MSG_ERRQUEUE
*/ */
int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len) int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
{ {
struct ipv6_pinfo *np = inet6_sk(sk); struct ipv6_pinfo *np = inet6_sk(sk);
struct sock_exterr_skb *serr; struct sock_exterr_skb *serr;
@ -369,6 +369,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
&sin->sin6_addr); &sin->sin6_addr);
sin->sin6_scope_id = 0; sin->sin6_scope_id = 0;
} }
*addr_len = sizeof(*sin);
} }
memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err)); memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
@ -423,7 +424,8 @@ EXPORT_SYMBOL_GPL(ipv6_recv_error);
/* /*
* Handle IPV6_RECVPATHMTU * Handle IPV6_RECVPATHMTU
*/ */
int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len) int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len,
int *addr_len)
{ {
struct ipv6_pinfo *np = inet6_sk(sk); struct ipv6_pinfo *np = inet6_sk(sk);
struct sk_buff *skb; struct sk_buff *skb;
@ -457,6 +459,7 @@ int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len)
sin->sin6_port = 0; sin->sin6_port = 0;
sin->sin6_scope_id = mtu_info.ip6m_addr.sin6_scope_id; sin->sin6_scope_id = mtu_info.ip6m_addr.sin6_scope_id;
sin->sin6_addr = mtu_info.ip6m_addr.sin6_addr; sin->sin6_addr = mtu_info.ip6m_addr.sin6_addr;
*addr_len = sizeof(*sin);
} }
put_cmsg(msg, SOL_IPV6, IPV6_PATHMTU, sizeof(mtu_info), &mtu_info); put_cmsg(msg, SOL_IPV6, IPV6_PATHMTU, sizeof(mtu_info), &mtu_info);

3
net/ipv6/ping.c
View File

@ -57,7 +57,8 @@ static struct inet_protosw pingv6_protosw = {
/* Compatibility glue so we can support IPv6 when it's compiled as a module */ /* Compatibility glue so we can support IPv6 when it's compiled as a module */
static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len) static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len,
int *addr_len)
{ {
return -EAFNOSUPPORT; return -EAFNOSUPPORT;
} }

4
net/ipv6/raw.c
View File

@ -466,10 +466,10 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
return -EOPNOTSUPP; return -EOPNOTSUPP;
if (flags & MSG_ERRQUEUE) if (flags & MSG_ERRQUEUE)
return ipv6_recv_error(sk, msg, len); return ipv6_recv_error(sk, msg, len, addr_len);
if (np->rxpmtu && np->rxopt.bits.rxpmtu) if (np->rxpmtu && np->rxopt.bits.rxpmtu)
return ipv6_recv_rxpmtu(sk, msg, len); return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
skb = skb_recv_datagram(sk, flags, noblock, &err); skb = skb_recv_datagram(sk, flags, noblock, &err);
if (!skb) if (!skb)

4
net/ipv6/udp.c
View File

@ -393,10 +393,10 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
bool slow; bool slow;
if (flags & MSG_ERRQUEUE) if (flags & MSG_ERRQUEUE)
return ipv6_recv_error(sk, msg, len); return ipv6_recv_error(sk, msg, len, addr_len);
if (np->rxpmtu && np->rxopt.bits.rxpmtu) if (np->rxpmtu && np->rxopt.bits.rxpmtu)
return ipv6_recv_rxpmtu(sk, msg, len); return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
try_again: try_again:
skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0), skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),

2
net/l2tp/l2tp_ip6.c
View File

@ -665,7 +665,7 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk,
*addr_len = sizeof(*lsa); *addr_len = sizeof(*lsa);
if (flags & MSG_ERRQUEUE) if (flags & MSG_ERRQUEUE)
return ipv6_recv_error(sk, msg, len); return ipv6_recv_error(sk, msg, len, addr_len);
skb = skb_recv_datagram(sk, flags, noblock, &err); skb = skb_recv_datagram(sk, flags, noblock, &err);
if (!skb) if (!skb)