lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 18 Feb 2016 12:39:46 +0000 From: Rainer Weikusat <rweikusat@...ileactivedefense.com> To: <davem@...emloft.net> Cc: <netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>, hannes@...essinduktion.org, <joseph.salisbury@...onical.com>, edumazet@...gle.com, rweikusat@...ileactivedefense.com Subject: [PATCH net] af_unix: Don't use continue to re-execute unix_stream_read_generic loop The unix_stream_read_generic function tries to use a continue statement to restart the receive loop after waiting for a message. This may not work as intended as the caller might use a recvmsg call to peek at control messages without specifying a message buffer. If this was the case, the continue will cause the function to return without an error and without the credential information if the function had to wait for a message while it had returned with the credentials otherwise. Change to using goto to restart the loop without checking the condition first in this case so that credentials are returned either way. Signed-off-by: Rainer Weikusat <rweikusat@...ileactivedefense.com> Acked-by: Hannes Frederic Sowa <hannes@...essinduktion.org> --- I'm resending this as the original patch seems to have been classified as superseded without anything actually superseding it. I hope the net is appropriate. I consider this a bugfix. diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index c51e283..f75f847 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -2312,6 +2312,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state) bool drop_skb; struct sk_buff *skb, *last; +redo: unix_state_lock(sk); if (sock_flag(sk, SOCK_DEAD)) { err = -ECONNRESET; @@ -2353,7 +2354,7 @@ again: } mutex_lock(&u->readlock); - continue; + goto redo; unlock: unix_state_unlock(sk); break;
Powered by blists - more mailing lists