netdev - Re: [PATCH 08/16] iucv: Fix missing msg_namelen update in iucv_sock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1365419659.6093.1.camel@BR9GV9YG.de.ibm.com>
Date:	Mon, 08 Apr 2013 13:14:19 +0200
From:	Ursula Braun <ubraun@...ux.vnet.ibm.com>
To:	Mathias Krause <minipli@...glemail.com>
Cc:	"David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org,
	Allan Stephens <allan.stephens@...driver.com>,
	Aloisio Almeida Jr <aloisio.almeida@...nbossa.org>,
	Andy King <acking@...are.com>,
	Arnaldo Carvalho de Melo <acme@...stprotocols.net>,
	Dmitry Torokhov <dtor@...are.com>,
	George Zhang <georgezhang@...are.com>,
	Gustavo Padovan <gustavo@...ovan.org>,
	Johan Hedberg <johan.hedberg@...il.com>,
	Jon Maloy <jon.maloy@...csson.com>,
	Lauro Ramos Venancio <lauro.venancio@...nbossa.org>,
	Marcel Holtmann <marcel@...tmann.org>,
	Ralf Baechle <ralf@...ux-mips.org>,
	Samuel Ortiz <sameo@...ux.intel.com>,
	Samuel Ortiz <samuel@...tiz.org>,
	Sjur Braendeland <sjur.brandeland@...ricsson.com>,
	Ursula Braun <ursula.braun@...ibm.com>,
	Brad Spengler <spender@...ecurity.net>
Subject: Re: [PATCH 08/16] iucv: Fix missing msg_namelen update in
 iucv_sock_recvmsg()

On Sun, 2013-04-07 at 13:51 +0200, Mathias Krause wrote:
> The current code does not fill the msg_name member in case it is set.
> It also does not set the msg_namelen member to 0 and therefore makes
> net/socket.c leak the local, uninitialized sockaddr_storage variable
> to userland -- 128 bytes of kernel stack memory.
> 
> Fix that by simply setting msg_namelen to 0 as obviously nobody cared
> about iucv_sock_recvmsg() not filling the msg_name in case it was set.
> 
> Cc: Ursula Braun <ursula.braun@...ibm.com>
> Signed-off-by: Mathias Krause <minipli@...glemail.com>
> ---
> Remark: I failed to test that one as I've no access to a S390 system.
> 
>  net/iucv/af_iucv.c |    2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
> index a7d11ffe..bf69358 100644
> --- a/net/iucv/af_iucv.c
> +++ b/net/iucv/af_iucv.c
> @@ -1328,6 +1328,8 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
>  	struct sk_buff *skb, *rskb, *cskb;
>  	int err = 0;
> 
> +	msg->msg_namelen = 0;
> +
>  	if ((sk->sk_state == IUCV_DISCONN) &&
>  	    skb_queue_empty(&iucv->backlog_skb_q) &&
>  	    skb_queue_empty(&sk->sk_receive_queue) &&
Acked-by: Ursula Braun <ursula.braun@...ibm.com>

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html