lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <afaeff665f994174bf5751fc9068fe6e@AcuMS.aculab.com> Date: Mon, 29 Apr 2019 16:01:43 +0000 From: David Laight <David.Laight@...LAB.COM> To: 'Willem de Bruijn' <willemdebruijn.kernel@...il.com>, "netdev@...r.kernel.org" <netdev@...r.kernel.org> CC: "davem@...emloft.net" <davem@...emloft.net>, Willem de Bruijn <willemb@...gle.com> Subject: RE: [PATCH net v2] packet: validate msg_namelen in send directly From: Willem de Bruijn > Sent: 29 April 2019 16:53 > Packet sockets in datagram mode take a destination address. Verify its > length before passing to dev_hard_header. > > Prior to 2.6.14-rc3, the send code ignored sll_halen. This is > established behavior. Directly compare msg_namelen to dev->addr_len. > > Change v1->v2: initialize addr in all paths > > Fixes: 6b8d95f1795c4 ("packet: validate address length if non-zero") > Suggested-by: David Laight <David.Laight@...lab.com> > Signed-off-by: Willem de Bruijn <willemb@...gle.com> > --- > net/packet/af_packet.c | 24 ++++++++++++++---------- > 1 file changed, 14 insertions(+), 10 deletions(-) > > diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c > index 9419c5cf4de5e..a43876b374da2 100644 > --- a/net/packet/af_packet.c > +++ b/net/packet/af_packet.c > @@ -2602,8 +2602,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) > void *ph; > DECLARE_SOCKADDR(struct sockaddr_ll *, saddr, msg->msg_name); > bool need_wait = !(msg->msg_flags & MSG_DONTWAIT); > + unsigned char *addr = NULL; > int tp_len, size_max; > - unsigned char *addr; > void *data; > int len_sum = 0; > int status = TP_STATUS_AVAILABLE; > @@ -2614,7 +2614,6 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) > if (likely(saddr == NULL)) { > dev = packet_cached_dev_get(po); > proto = po->num; > - addr = NULL; > } else { > err = -EINVAL; > if (msg->msg_namelen < sizeof(struct sockaddr_ll)) > @@ -2624,10 +2623,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) > sll_addr))) > goto out; > proto = saddr->sll_protocol; > - addr = saddr->sll_halen ? saddr->sll_addr : NULL; > dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex); > - if (addr && dev && saddr->sll_halen < dev->addr_len) > - goto out_put; > + if (po->sk.sk_socket->type == SOCK_DGRAM) { > + if (dev && msg->msg_namelen < dev->addr_len + > + offsetof(struct sockaddr_ll, sll_addr)) > + goto out_put; > + addr = saddr->sll_addr; > + } > } > > err = -ENXIO; > @@ -2799,7 +2801,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) > struct sk_buff *skb; > struct net_device *dev; > __be16 proto; > - unsigned char *addr; > + unsigned char *addr = NULL; > int err, reserve = 0; > struct sockcm_cookie sockc; > struct virtio_net_hdr vnet_hdr = { 0 }; > @@ -2816,7 +2818,6 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) > if (likely(saddr == NULL)) { > dev = packet_cached_dev_get(po); > proto = po->num; > - addr = NULL; > } else { > err = -EINVAL; > if (msg->msg_namelen < sizeof(struct sockaddr_ll)) > @@ -2824,10 +2825,13 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) > if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr))) > goto out; > proto = saddr->sll_protocol; > - addr = saddr->sll_halen ? saddr->sll_addr : NULL; > dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex); > - if (addr && dev && saddr->sll_halen < dev->addr_len) > - goto out_unlock; > + if (sock->type == SOCK_DGRAM) { > + if (dev && msg->msg_namelen < dev->addr_len + > + offsetof(struct sockaddr_ll, sll_addr)) > + goto out_unlock; > + addr = saddr->sll_addr; > + } > } > > err = -ENXIO; > -- > 2.21.0.593.g511ec345e18-goog LGTM David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
Powered by blists - more mailing lists