lkml.org 
[lkml]   [2020]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 182/343] packet: in recvmsg msg_name return at least sizeof sockaddr_ll
    Date
    From: Willem de Bruijn <willemb@google.com>

    [ Upstream commit b2cf86e1563e33a14a1c69b3e508d15dc12f804c ]

    Packet send checks that msg_name is at least sizeof sockaddr_ll.
    Packet recv must return at least this length, so that its output
    can be passed unmodified to packet send.

    This ceased to be true since adding support for lladdr longer than
    sll_addr. Since, the return value uses true address length.

    Always return at least sizeof sockaddr_ll, even if address length
    is shorter. Zero the padding bytes.

    Change v1->v2: do not overwrite zeroed padding again. use copy_len.

    Fixes: 0fb375fb9b93 ("[AF_PACKET]: Allow for > 8 byte hardware addresses.")
    Suggested-by: David Laight <David.Laight@aculab.com>
    Signed-off-by: Willem de Bruijn <willemb@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/packet/af_packet.c | 13 +++++++++++--
    1 file changed, 11 insertions(+), 2 deletions(-)

    diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
    index 4e1058159b082..e788f9c7c3984 100644
    --- a/net/packet/af_packet.c
    +++ b/net/packet/af_packet.c
    @@ -3407,20 +3407,29 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
    sock_recv_ts_and_drops(msg, sk, skb);

    if (msg->msg_name) {
    + int copy_len;
    +
    /* If the address length field is there to be filled
    * in, we fill it in now.
    */
    if (sock->type == SOCK_PACKET) {
    __sockaddr_check_size(sizeof(struct sockaddr_pkt));
    msg->msg_namelen = sizeof(struct sockaddr_pkt);
    + copy_len = msg->msg_namelen;
    } else {
    struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll;

    msg->msg_namelen = sll->sll_halen +
    offsetof(struct sockaddr_ll, sll_addr);
    + copy_len = msg->msg_namelen;
    + if (msg->msg_namelen < sizeof(struct sockaddr_ll)) {
    + memset(msg->msg_name +
    + offsetof(struct sockaddr_ll, sll_addr),
    + 0, sizeof(sll->sll_addr));
    + msg->msg_namelen = sizeof(struct sockaddr_ll);
    + }
    }
    - memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
    - msg->msg_namelen);
    + memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len);
    }

    if (pkt_sk(sk)->auxdata) {
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-01-24 10:56    [W:4.044 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site