linux-kernel - Re: [ 26/48] net:socket: set msg_namelen to 0 if msg_name is passed as NULL in msghdr struct from userland.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1431724102.6315.130.camel@decadent.org.uk>
Date:	Fri, 15 May 2015 22:08:22 +0100
From:	Ben Hutchings <ben@...adent.org.uk>
To:	Willy Tarreau <w@....eu>
Cc:	linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	Ani Sinha <ani@...sta.com>,
	"David S. Miller" <davem@...emloft.net>
Subject: Re: [ 26/48] net:socket: set msg_namelen to 0 if msg_name is passed
 as NULL in msghdr struct from userland.

On Fri, 2015-05-15 at 10:05 +0200, Willy Tarreau wrote:
> 2.6.32-longterm review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Ani Sinha <ani@...sta.com>
> 
> commit 6a2a2b3ae0759843b22c929881cc184b00cc63ff upstream.
> 
> Linux manpage for recvmsg and sendmsg calls does not explicitly mention setting msg_namelen to 0 when
> msg_name passed set as NULL. When developers don't set msg_namelen member in msghdr, it might contain garbage
> value which will fail the validation check and sendmsg and recvmsg calls from kernel will return EINVAL. This will
> break old binaries and any code for which there is no access to source code.
> To fix this, we set msg_namelen to 0 when msg_name is passed as NULL from userland.
[...]

I think you'll also want this related fix:

commit 91edd096e224941131f896b86838b1e59553696a
Author: Catalin Marinas <catalin.marinas@....com>
Date:   Fri Mar 20 16:48:13 2015 +0000

    net: compat: Update get_compat_msghdr() to match copy_msghdr_from_user() behaviour

Ben.

-- 
Ben Hutchings
It is impossible to make anything foolproof because fools are so ingenious.

Download attachment "signature.asc" of type "application/pgp-signature" (812 bytes)