lkml.org 
[lkml]   [2020]   [Jul]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRE: [PATCH] Fix memory overwriting issue when copy an address to user space
Date
From: lebon zhou
> Sent: 20 July 2020 05:35
> To: davem@davemloft.net; kuba@kernel.org
> Cc: linux-kernel@vger.kernel.org; netdev@vger.kernel.org
> Subject: [PATCH] Fix memory overwriting issue when copy an address to user space
>
> When application provided buffer size less than sockaddr_storage, then
> kernel will overwrite some memory area which may cause memory corruption,
> e.g.: in recvmsg case, let msg_name=malloc(8) and msg_namelen=8, then
> usually application can call recvmsg successful but actually application
> memory get corrupted.

Where?
The copy_to_user() uses the short length provided by the user.
There is even a comment saying that if the address is truncated
the length returned to the user is the full length.

Maybe the application is reusing the msg without re-initialising
it properly.

David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
\
 
 \ /
  Last update: 2020-07-20 17:13    [W:0.254 / U:0.056 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site