lkml.org 
[lkml]   [2014]   [Jul]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] net: sendmsg: fix NULL pointer dereference
From
From: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Date: Sat, 26 Jul 2014 21:26:58 +0400

> Sasha's report:
...
> This reports means that we've come to netlink_sendmsg() with msg->msg_name == NULL and msg->msg_namelen > 0.
>
> After this report there was no usual "Unable to handle kernel NULL pointer dereference"
> and this gave me a clue that address 0 is mapped and contains valid socket address structure in it.
>
> This bug was introduced in f3d3342602f8bcbf37d7c46641cb9bca7618eb1c
> (net: rework recvmsg handler msg_name and msg_namelen logic).
> Commit message states that:
> "Set msg->msg_name = NULL if user specified a NULL in msg_name but had a
> non-null msg_namelen in verify_iovec/verify_compat_iovec. This doesn't
> affect sendto as it would bail out earlier while trying to copy-in the
> address."
> But in fact this affects sendto when address 0 is mapped and contains
> socket address structure in it. In such case copy-in address will succeed,
> verify_iovec() function will successfully exit with msg->msg_namelen > 0
> and msg->msg_name == NULL.
>
> This patch fixes it by setting msg_namelen to 0 if msg_name == NULL.
>
> Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
> Cc: Eric Dumazet <edumazet@google.com>
> Cc: <stable@vger.kernel.org>
> Reported-by: Sasha Levin <sasha.levin@oracle.com>
> Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com>

Applied and queued up for -stable, thanks!


\
 
 \ /
  Last update: 2014-07-29 22:01    [W:0.286 / U:0.044 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site