netdev - Re: [PATCH net] packet: in recvmsg msg_name return at least sockaddr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 26 Apr 2019 17:57:38 -0400
From:   Willem de Bruijn <willemdebruijn.kernel@...il.com>
To:     Network Development <netdev@...r.kernel.org>
Cc:     David Miller <davem@...emloft.net>,
        David Laight <David.Laight@...lab.com>,
        "Eric W. Biederman" <ebiederm@...ssion.com>,
        Willem de Bruijn <willemb@...gle.com>
Subject: Re: [PATCH net] packet: in recvmsg msg_name return at least sockaddr_ll

On Fri, Apr 26, 2019 at 3:29 PM Willem de Bruijn
<willemdebruijn.kernel@...il.com> wrote:
>
> From: Willem de Bruijn <willemb@...gle.com>
>
> Packet send checks that msg_name is at least sizeof sockaddr_ll.
> Packet recv must return at least this length, so that its output
> can be passed unmodified to packet send.
>
> This ceased to be true since adding support for lladdr longer than
> sll_addr. Since, the return value uses true address length.
>
> Always return at least sizeof sockaddr_ll, even if address length
> is shorter. Zero the padding bytes.
>
> Fixes: 0fb375fb9b93 ("[AF_PACKET]: Allow for > 8 byte hardware addresses.")
> Suggested-by: David Laight <David.Laight@...lab.com>
> Signed-off-by: Willem de Bruijn <willemb@...gle.com>
> ---
>  net/packet/af_packet.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
> index 13301e36b4a28..ca38e75c702e7 100644
> --- a/net/packet/af_packet.c
> +++ b/net/packet/af_packet.c
> @@ -3358,9 +3358,14 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
>                         msg->msg_namelen = sizeof(struct sockaddr_pkt);
>                 } else {
>                         struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll;
> -

Did not mean to remove this whitespace line.

Will fix up, but will leave this out for review as is for now.

>                         msg->msg_namelen = sll->sll_halen +
>                                 offsetof(struct sockaddr_ll, sll_addr);
> +                       if (msg->msg_namelen < sizeof(struct sockaddr_ll)) {
> +                               memset(msg->msg_name +
> +                                      offsetof(struct sockaddr_ll, sll_addr),
> +                                      0, sizeof(sll->sll_addr));
> +                               msg->msg_namelen = sizeof(struct sockaddr_ll);
> +                       }
>                 }
>                 memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
>                        msg->msg_namelen);
> --
> 2.21.0.593.g511ec345e18-goog
>