Messages in this thread Patch in this message | | | From | lebon zhou <> | Date | Fri, 17 Jul 2020 10:31:54 +0000 | Subject | [PATCH] Fix memory overwriting issue when copy an address to user space |
| |
When application provided buffer size less than sockaddr_storage, then kernel will overwrite some memory area which may cause memory corruption, e.g.: in recvmsg case, let msg_name=malloc(8) and msg_namelen=8, then usually application can call recvmsg successful but actually application memory get corrupted.
Fix to return EINVAL when application buffer size less than sockaddr_storage.
Signed-off-by: lebon.zhou <lebon.zhou@gmail.com> --- net/socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/socket.c b/net/socket.c index 976426d03f09..dc32b1b899df 100644 --- a/net/socket.c +++ b/net/socket.c @@ -229,7 +229,7 @@ static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen, return err; if (len > klen) len = klen; - if (len < 0) + if (len < 0 || len < klen) return -EINVAL; if (len) { if (audit_sockaddr(klen, kaddr)) -- 2.22.0
| |