diff options
| author | Dan Carpenter | 2013-11-27 13:40:21 +0100 |
|---|---|---|
| committer | David S. Miller | 2013-11-29 22:12:52 +0100 |
| commit | db31c55a6fb245fdbb752a2ca4aefec89afabb06 (patch) | |
| tree | ab94a0065aaa0db14bdca1ae6c92b6e29a086165 /net/compat.c | |
| parent | af_packet: block BH in prb_shutdown_retire_blk_timer() (diff) | |
| download | kernel-qcow2-linux-db31c55a6fb245fdbb752a2ca4aefec89afabb06.tar.gz kernel-qcow2-linux-db31c55a6fb245fdbb752a2ca4aefec89afabb06.tar.xz kernel-qcow2-linux-db31c55a6fb245fdbb752a2ca4aefec89afabb06.zip | |
net: clamp ->msg_namelen instead of returning an error
If kmsg->msg_namelen > sizeof(struct sockaddr_storage) then in the
original code that would lead to memory corruption in the kernel if you
had audit configured. If you didn't have audit configured it was
harmless.
There are some programs such as beta versions of Ruby which use too
large of a buffer and returning an error code breaks them. We should
clamp the ->msg_namelen value instead.
Fixes: 1661bf364ae9 ("net: heap overflow in __audit_sockaddr()")
Reported-by: Eric Wong <normalperson@yhbt.net>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Tested-by: Eric Wong <normalperson@yhbt.net>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/compat.c')
| -rw-r--r-- | net/compat.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/compat.c b/net/compat.c index 618c6a8a911b..dd32e34c1e2c 100644 --- a/net/compat.c +++ b/net/compat.c @@ -72,7 +72,7 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg) __get_user(kmsg->msg_flags, &umsg->msg_flags)) return -EFAULT; if (kmsg->msg_namelen > sizeof(struct sockaddr_storage)) - return -EINVAL; + kmsg->msg_namelen = sizeof(struct sockaddr_storage); kmsg->msg_name = compat_ptr(tmp1); kmsg->msg_iov = compat_ptr(tmp2); kmsg->msg_control = compat_ptr(tmp3); |