netdev - very odd check in caif_seqpkt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Thu, 20 Nov 2014 08:54:25 +0000
From:	Al Viro <viro@...IV.linux.org.uk>
To:	Dmitry Tarnyagin <dmitry.tarnyagin@...kless.no>
Cc:	netdev@...r.kernel.org
Subject: very odd check in caif_seqpkt_sendmsg()

This check is very odd:
        if (unlikely(msg->msg_iov->iov_base == NULL))
                goto err;
What happens if we get call it with msg_iovlen being 0?  verify_iovec()
(or rw_copy_check_uvector(), for that matter) is just fine with that -
sendmsg() purely for msg_control is normal on e.g. AF_UNIX sockets.
And we end with ->msg_iov pointing to iovstack[], with iovstack[0] being
uninitialized.  So at the very least your check is going to yield random
results in that case.

What is it supposed to check for?  Note that memcpy_fromiovec() won't blow
up on NULL ->iov_base - with zero len it won't even look there and with
non-zero it'll fail with -EFAULT.

Was that intended to be if (unlikely(!len)) fail with EINVAL?  Something
entirely different?
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html