netdev - Re: sys_sendmsg Fails Silently With Negative msg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87fvmqwcq3.fsf@e106496-lin.cambridge.arm.com>
Date:	Mon, 10 Mar 2014 10:48:52 +0000
From:	Matthew Leach <matthew.leach@....com>
To:	Dan Carpenter <dan.carpenter@...cle.com>
Cc:	"netdev\@vger.kernel.org" <netdev@...r.kernel.org>,
	"David S. Miller" <davem@...emloft.net>,
	Will Deacon <Will.Deacon@....com>
Subject: Re: sys_sendmsg Fails Silently With Negative msg_namelen

Hi Dan,

Dan Carpenter <dan.carpenter@...cle.com> writes:

[...]

> I think Ruby was using larger buffer sizes than necessary so we could
> add something like:
>
> 	if (kmsg->msg_namelen < 0)
> 		return -EINVAL;
> 	if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
>   		kmsg->msg_namelen = sizeof(struct sockaddr_storage);

I don't see how your patch does anything different?  If we don't clamp
the value and leave it as -1 the check for a negative buffer size
eventually happens in move_addr_to_kernel anyway, just before we copy
the buffer from userspace.  This check fails and returns EINVAL.

>
>
> Why are people passing -1 as the buffer size anyway?  

This was actually found with LTP.  The sendmsg01 test passes -1 as the
msg_namelen parameter and expects the syscall to fail.

> Your email suggests that people expect it to work, and it will work
> fine if you have a buffer size which is larger than sizeof(struct
> sockaddr_storage).  I'm nervous about changing something which works
> fine in case I break userspace.  A second time.  :P

Agreed, but IMHO passing -1 as a buffer size should cause a syscall to
fail, rather than assuming we can copy from the buffer.

-- 
Matt

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html