netdev - Re: [Bugme-new] [Bug 10371] New: On big-endian machines getsockopt returns 0 (via optval) for optlen==1 when returned value should 255

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 31 Mar 2008 11:33:49 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	M.Piechaczek@...osys.tv
Cc:	bugme-daemon@...zilla.kernel.org, netdev@...r.kernel.org
Subject: Re: [Bugme-new] [Bug 10371] New: On big-endian machines getsockopt
 returns 0 (via optval) for optlen==1 when returned value should 255

On Mon, 31 Mar 2008 08:16:05 -0700 (PDT) bugme-daemon@...zilla.kernel.org wrote:

> http://bugzilla.kernel.org/show_bug.cgi?id=10371
> 
>            Summary: On big-endian machines getsockopt returns 0 (via optval)
>                     for optlen==1 when returned value should 255
>            Product: Networking
>            Version: 2.5
>      KernelVersion: 2.6.24
>           Platform: All
>         OS/Version: Linux
>               Tree: Mainline
>             Status: NEW
>           Severity: normal
>           Priority: P1
>          Component: IPV4
>         AssignedTo: shemminger@...ux-foundation.org
>         ReportedBy: M.Piechaczek@...osys.tv
> 
> 
> Latest working kernel version: 
> Earliest failing kernel version: all 2.6
> Distribution: 
> Hardware Environment: 
> Software Environment: 
> Problem Description: 
> 
> On big-endian machines getsockopt fails for optlen==1 when returned value is
> 255.
> Eg. after calling
>   unsigned char ttl = 255;
>   socklen_t     len = sizeof(ttl);
>   setsockopt(socket, IPPROTO_IP, IP_MULTICAST_TTL, &ttl, &len);
> the following call will fail:
>   getsockopt(socket, IPPROTO_IP, IP_MULTICAST_TTL, &ttl, &len);
> "ttl" returned will be 0.
> 
> 
> It's because of bug in /net/ipv4/ip_sockglue.c:
> 
>  static int do_ip_getsockopt(struct sock *sk, int level, int optname,
>                             char __user *optval, int __user *optlen) 
>  ....
>         if (len < sizeof(int) && len > 0 && val>=0 && val<255) {
>                 unsigned char ucval = (unsigned char)val;
>                 len = 1;
>                 if (put_user(len, optlen))
>                         return -EFAULT;
>                 if (copy_to_user(optval,&ucval,1))
>                         return -EFAULT;
>         } else {
>                 len = min_t(unsigned int, sizeof(int), len);
>                 if (put_user(len, optlen))
>                         return -EFAULT;
>                 if (copy_to_user(optval,&val,len))
>                         return -EFAULT;
>         }
>         return 0;
> } 
> 
> The comparision in if-statement should be:
>         if (len < sizeof(int) && len > 0 && val>=0 && val<=255)
> 
> Otherwise on big-endian machines copy_to_user(optval,&val,len) routine copies
> first (highest) byte which is 0 in that case.
> 
> 
> This bug does not occur on low-endian machines since
> copy_to_user(optval,&val,len) copies right (lowest) byte in that case.
> 

You've done all the hard work - please email us a tested patch?
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html