netdev - Re: [PATCH] net: rework recvmsg handler msg_name and msg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1384996730.10637.28.camel@edumazet-glaptop2.roam.corp.google.com>
Date:	Wed, 20 Nov 2013 17:18:50 -0800
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Hannes Frederic Sowa <hannes@...essinduktion.org>
Cc:	Joe Perches <joe@...ches.com>, netdev@...r.kernel.org,
	davem@...emloft.net
Subject: Re: [PATCH] net: rework recvmsg handler msg_name and msg_namelen
 logic

On Thu, 2013-11-21 at 02:07 +0100, Hannes Frederic Sowa wrote:
> On Wed, Nov 20, 2013 at 05:02:40PM -0800, Joe Perches wrote:
> > On Thu, 2013-11-21 at 01:38 +0100, Hannes Frederic Sowa wrote:
> > > This patch now always passes msg->msg_namelen as 0. recvmsg handlers must
> > > set msg_namelen to the proper size <= sizeof(struct sockaddr_storage)
> > > to return msg_name to the user.
> > []
> > > This change does not alter the user visible error logic as we ignore
> > > msg_namelen as long as msg_name is NULL.
> > > 
> > > Also remove two unnecessary curly brackets in ___sys_recvmsg and change
> > > comments to netdev style.
> > 
> > Perhaps take the opportunity to remove the unnecessary casts of
> > struct msghdr.msg_name as it's a void *.
> > 
> > And there's one other oddity about setting a known NULL to NULL.
> > 
> > Maybe fix in a follow-on patch?
> 
> No, that is easily done in this one. I'll send a v2 shortly.
> 
> Thanks!
> 

In move_addr_to_user() there is this strange test :

        if (len > klen)
                len = klen;
        if (len < 0 || len > sizeof(struct sockaddr_storage))
                return -EINVAL;

I would suggest to instead use :

if (len < 0)
	return -EINVAL;
BUG_ON(len > sizeof(struct sockaddr_storage));

To catch if some protocols are using more than 128 bytes.

We can then remove the BUG_ON() later.


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html