linux-kernel - Re: [ 080/143] net: rework recvmsg handler msg_name and msg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140514054535.GA1562@1wt.eu>
Date:	Wed, 14 May 2014 07:45:35 +0200
From:	Willy Tarreau <w@....eu>
To:	Luis Henriques <luis.henriques@...onical.com>
Cc:	linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	David Miller <davem@...emloft.net>,
	Hannes Frederic Sowa <hannes@...essinduktion.org>
Subject: Re: [ 080/143] net: rework recvmsg handler msg_name and msg_namelen logic

Hi Luis,

On Tue, May 13, 2014 at 01:44:25PM +0100, Luis Henriques wrote:
> On Mon, May 12, 2014 at 02:33:20AM +0200, Willy Tarreau wrote:
> > 2.6.32-longterm review patch.  If anyone has any objections, please let me know.
> > 
> > ------------------
> > 
> > From: Hannes Frederic Sowa <hannes@...essinduktion.org>
> > 
> > [ Upstream commit f3d3342602f8bcbf37d7c46641cb9bca7618eb1c ]
> > 
> 
> <snip>
> 
> > diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
> > index a39bf97..f779fc3 100644
> > --- a/net/rxrpc/ar-recvmsg.c
> > +++ b/net/rxrpc/ar-recvmsg.c
> > @@ -142,10 +142,12 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock,
> >  
> >  		/* copy the peer address and timestamp */
> >  		if (!continue_call) {
> > -			if (msg->msg_name && msg->msg_namelen > 0)
> > +			if (msg->msg_name) {
> > +				size_t len =
> > +					sizeof(call->conn->trans->peer->srx);
> >  				memcpy(msg->msg_name,
> > -				       &call->conn->trans->peer->srx,
> > -				       sizeof(call->conn->trans->peer->srx));
> > +				       &call->conn->trans->peer->srx, len);
>   +                                    msg->msg_namelen = len;
> 
> This statement^^^ is missing in this backport.
> 
> Also missing in this patch are the changes to the following functions:
> 
> - pppoe_recvmsg()
>   In file drivers/net/pppoe.c instead of drivers/net/ppp/pppoe.c
> 
> - pppol2tp_recvmsg()
>   In file drivers/net/pppol2tp.c instead of net/l2tp/l2tp_ppp.c
> 
> For reference, I'm attaching the backport we have used in our Ubuntu
> kernel.  (Note that we added some extra information to the commit
> message to include the CVE number and a link to the CVE bug.)

Just a quick note to let you know that your patch applied well, and
that the diff between the two correctly reports the parts you pointed
above. So I'm taking it instead.

Thanks!
Willy

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/