diff options
author | Hannes Frederic Sowa <hannes@stressinduktion.org> | 2013-11-22 18:46:12 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2013-11-23 17:46:23 -0500 |
commit | 85fbaa75037d0b6b786ff18658ddf0b4014ce2a4 (patch) | |
tree | 7b0fdc3767421d9bc9c2157f6b652026fbff99dd | |
parent | ca15a078bd907df5fc1c009477869c5cbde3b753 (diff) |
inet: fix addr_len/msg->msg_namelen assignment in recv_error and rxpmtu functions
Commit bceaa90240b6019ed73b49965eac7d167610be69 ("inet: prevent leakage
of uninitialized memory to user in recv syscalls") conditionally updated
addr_len if the msg_name is written to. The recv_error and rxpmtu
functions relied on the recvmsg functions to set up addr_len before.
As this does not happen any more we have to pass addr_len to those
functions as well and set it to the size of the corresponding sockaddr
length.
This broke traceroute and such.
Fixes: bceaa90240b6 ("inet: prevent leakage of uninitialized memory to user in recv syscalls")
Reported-by: Brad Spengler <spender@grsecurity.net>
Reported-by: Tom Labanowski
Cc: mpb <mpb.mail@gmail.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r-- | include/net/ip.h | 2 | ||||
-rw-r--r-- | include/net/ipv6.h | 6 | ||||
-rw-r--r-- | include/net/ping.h | 3 | ||||
-rw-r--r-- | net/ipv4/ip_sockglue.c | 3 | ||||
-rw-r--r-- | net/ipv4/ping.c | 5 | ||||
-rw-r--r-- | net/ipv4/raw.c | 2 | ||||
-rw-r--r-- | net/ipv4/udp.c | 2 | ||||
-rw-r--r-- | net/ipv6/datagram.c | 7 | ||||
-rw-r--r-- | net/ipv6/ping.c | 3 | ||||
-rw-r--r-- | net/ipv6/raw.c | 4 | ||||
-rw-r--r-- | net/ipv6/udp.c | 4 | ||||
-rw-r--r-- | net/l2tp/l2tp_ip6.c | 2 |
12 files changed, 26 insertions, 17 deletions
diff --git a/include/net/ip.h b/include/net/ip.h index 217bc5bfc6c6..5a25f36fe3a7 100644 --- a/include/net/ip.h +++ b/include/net/ip.h | |||
@@ -473,7 +473,7 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname, | |||
473 | int ip_ra_control(struct sock *sk, unsigned char on, | 473 | int ip_ra_control(struct sock *sk, unsigned char on, |
474 | void (*destructor)(struct sock *)); | 474 | void (*destructor)(struct sock *)); |
475 | 475 | ||
476 | int ip_recv_error(struct sock *sk, struct msghdr *msg, int len); | 476 | int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len); |
477 | void ip_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port, | 477 | void ip_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port, |
478 | u32 info, u8 *payload); | 478 | u32 info, u8 *payload); |
479 | void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 dport, | 479 | void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 dport, |
diff --git a/include/net/ipv6.h b/include/net/ipv6.h index 2a5f668cd683..eb198acaac1d 100644 --- a/include/net/ipv6.h +++ b/include/net/ipv6.h | |||
@@ -776,8 +776,10 @@ int compat_ipv6_getsockopt(struct sock *sk, int level, int optname, | |||
776 | 776 | ||
777 | int ip6_datagram_connect(struct sock *sk, struct sockaddr *addr, int addr_len); | 777 | int ip6_datagram_connect(struct sock *sk, struct sockaddr *addr, int addr_len); |
778 | 778 | ||
779 | int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len); | 779 | int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, |
780 | int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len); | 780 | int *addr_len); |
781 | int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len, | ||
782 | int *addr_len); | ||
781 | void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port, | 783 | void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port, |
782 | u32 info, u8 *payload); | 784 | u32 info, u8 *payload); |
783 | void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info); | 785 | void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info); |
diff --git a/include/net/ping.h b/include/net/ping.h index 3f67704f3747..90f48417b03d 100644 --- a/include/net/ping.h +++ b/include/net/ping.h | |||
@@ -31,7 +31,8 @@ | |||
31 | 31 | ||
32 | /* Compatibility glue so we can support IPv6 when it's compiled as a module */ | 32 | /* Compatibility glue so we can support IPv6 when it's compiled as a module */ |
33 | struct pingv6_ops { | 33 | struct pingv6_ops { |
34 | int (*ipv6_recv_error)(struct sock *sk, struct msghdr *msg, int len); | 34 | int (*ipv6_recv_error)(struct sock *sk, struct msghdr *msg, int len, |
35 | int *addr_len); | ||
35 | int (*ip6_datagram_recv_ctl)(struct sock *sk, struct msghdr *msg, | 36 | int (*ip6_datagram_recv_ctl)(struct sock *sk, struct msghdr *msg, |
36 | struct sk_buff *skb); | 37 | struct sk_buff *skb); |
37 | int (*icmpv6_err_convert)(u8 type, u8 code, int *err); | 38 | int (*icmpv6_err_convert)(u8 type, u8 code, int *err); |
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 3f858266fa7e..ddf32a6bc415 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c | |||
@@ -386,7 +386,7 @@ void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 port, u32 inf | |||
386 | /* | 386 | /* |
387 | * Handle MSG_ERRQUEUE | 387 | * Handle MSG_ERRQUEUE |
388 | */ | 388 | */ |
389 | int ip_recv_error(struct sock *sk, struct msghdr *msg, int len) | 389 | int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) |
390 | { | 390 | { |
391 | struct sock_exterr_skb *serr; | 391 | struct sock_exterr_skb *serr; |
392 | struct sk_buff *skb, *skb2; | 392 | struct sk_buff *skb, *skb2; |
@@ -423,6 +423,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len) | |||
423 | serr->addr_offset); | 423 | serr->addr_offset); |
424 | sin->sin_port = serr->port; | 424 | sin->sin_port = serr->port; |
425 | memset(&sin->sin_zero, 0, sizeof(sin->sin_zero)); | 425 | memset(&sin->sin_zero, 0, sizeof(sin->sin_zero)); |
426 | *addr_len = sizeof(*sin); | ||
426 | } | 427 | } |
427 | 428 | ||
428 | memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err)); | 429 | memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err)); |
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c index 876c6ca2d8f9..840cf1b9e6ee 100644 --- a/net/ipv4/ping.c +++ b/net/ipv4/ping.c | |||
@@ -841,10 +841,11 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, | |||
841 | 841 | ||
842 | if (flags & MSG_ERRQUEUE) { | 842 | if (flags & MSG_ERRQUEUE) { |
843 | if (family == AF_INET) { | 843 | if (family == AF_INET) { |
844 | return ip_recv_error(sk, msg, len); | 844 | return ip_recv_error(sk, msg, len, addr_len); |
845 | #if IS_ENABLED(CONFIG_IPV6) | 845 | #if IS_ENABLED(CONFIG_IPV6) |
846 | } else if (family == AF_INET6) { | 846 | } else if (family == AF_INET6) { |
847 | return pingv6_ops.ipv6_recv_error(sk, msg, len); | 847 | return pingv6_ops.ipv6_recv_error(sk, msg, len, |
848 | addr_len); | ||
848 | #endif | 849 | #endif |
849 | } | 850 | } |
850 | } | 851 | } |
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c index 5cb8ddb505ee..23c3e5b5bb53 100644 --- a/net/ipv4/raw.c +++ b/net/ipv4/raw.c | |||
@@ -697,7 +697,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, | |||
697 | goto out; | 697 | goto out; |
698 | 698 | ||
699 | if (flags & MSG_ERRQUEUE) { | 699 | if (flags & MSG_ERRQUEUE) { |
700 | err = ip_recv_error(sk, msg, len); | 700 | err = ip_recv_error(sk, msg, len, addr_len); |
701 | goto out; | 701 | goto out; |
702 | } | 702 | } |
703 | 703 | ||
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 5944d7d668dd..44dfaa09b584 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c | |||
@@ -1236,7 +1236,7 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, | |||
1236 | bool slow; | 1236 | bool slow; |
1237 | 1237 | ||
1238 | if (flags & MSG_ERRQUEUE) | 1238 | if (flags & MSG_ERRQUEUE) |
1239 | return ip_recv_error(sk, msg, len); | 1239 | return ip_recv_error(sk, msg, len, addr_len); |
1240 | 1240 | ||
1241 | try_again: | 1241 | try_again: |
1242 | skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0), | 1242 | skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0), |
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c index a454b0ff57c7..d690204a0275 100644 --- a/net/ipv6/datagram.c +++ b/net/ipv6/datagram.c | |||
@@ -318,7 +318,7 @@ void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu) | |||
318 | /* | 318 | /* |
319 | * Handle MSG_ERRQUEUE | 319 | * Handle MSG_ERRQUEUE |
320 | */ | 320 | */ |
321 | int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len) | 321 | int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) |
322 | { | 322 | { |
323 | struct ipv6_pinfo *np = inet6_sk(sk); | 323 | struct ipv6_pinfo *np = inet6_sk(sk); |
324 | struct sock_exterr_skb *serr; | 324 | struct sock_exterr_skb *serr; |
@@ -369,6 +369,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len) | |||
369 | &sin->sin6_addr); | 369 | &sin->sin6_addr); |
370 | sin->sin6_scope_id = 0; | 370 | sin->sin6_scope_id = 0; |
371 | } | 371 | } |
372 | *addr_len = sizeof(*sin); | ||
372 | } | 373 | } |
373 | 374 | ||
374 | memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err)); | 375 | memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err)); |
@@ -423,7 +424,8 @@ EXPORT_SYMBOL_GPL(ipv6_recv_error); | |||
423 | /* | 424 | /* |
424 | * Handle IPV6_RECVPATHMTU | 425 | * Handle IPV6_RECVPATHMTU |
425 | */ | 426 | */ |
426 | int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len) | 427 | int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len, |
428 | int *addr_len) | ||
427 | { | 429 | { |
428 | struct ipv6_pinfo *np = inet6_sk(sk); | 430 | struct ipv6_pinfo *np = inet6_sk(sk); |
429 | struct sk_buff *skb; | 431 | struct sk_buff *skb; |
@@ -457,6 +459,7 @@ int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len) | |||
457 | sin->sin6_port = 0; | 459 | sin->sin6_port = 0; |
458 | sin->sin6_scope_id = mtu_info.ip6m_addr.sin6_scope_id; | 460 | sin->sin6_scope_id = mtu_info.ip6m_addr.sin6_scope_id; |
459 | sin->sin6_addr = mtu_info.ip6m_addr.sin6_addr; | 461 | sin->sin6_addr = mtu_info.ip6m_addr.sin6_addr; |
462 | *addr_len = sizeof(*sin); | ||
460 | } | 463 | } |
461 | 464 | ||
462 | put_cmsg(msg, SOL_IPV6, IPV6_PATHMTU, sizeof(mtu_info), &mtu_info); | 465 | put_cmsg(msg, SOL_IPV6, IPV6_PATHMTU, sizeof(mtu_info), &mtu_info); |
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c index 8815e31a87fe..a83243c3d656 100644 --- a/net/ipv6/ping.c +++ b/net/ipv6/ping.c | |||
@@ -57,7 +57,8 @@ static struct inet_protosw pingv6_protosw = { | |||
57 | 57 | ||
58 | 58 | ||
59 | /* Compatibility glue so we can support IPv6 when it's compiled as a module */ | 59 | /* Compatibility glue so we can support IPv6 when it's compiled as a module */ |
60 | static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len) | 60 | static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, |
61 | int *addr_len) | ||
61 | { | 62 | { |
62 | return -EAFNOSUPPORT; | 63 | return -EAFNOSUPPORT; |
63 | } | 64 | } |
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c index e24ff1df0401..7fb4e14c467f 100644 --- a/net/ipv6/raw.c +++ b/net/ipv6/raw.c | |||
@@ -466,10 +466,10 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk, | |||
466 | return -EOPNOTSUPP; | 466 | return -EOPNOTSUPP; |
467 | 467 | ||
468 | if (flags & MSG_ERRQUEUE) | 468 | if (flags & MSG_ERRQUEUE) |
469 | return ipv6_recv_error(sk, msg, len); | 469 | return ipv6_recv_error(sk, msg, len, addr_len); |
470 | 470 | ||
471 | if (np->rxpmtu && np->rxopt.bits.rxpmtu) | 471 | if (np->rxpmtu && np->rxopt.bits.rxpmtu) |
472 | return ipv6_recv_rxpmtu(sk, msg, len); | 472 | return ipv6_recv_rxpmtu(sk, msg, len, addr_len); |
473 | 473 | ||
474 | skb = skb_recv_datagram(sk, flags, noblock, &err); | 474 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
475 | if (!skb) | 475 | if (!skb) |
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index 81eb8cf8389b..bcd5699313c3 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c | |||
@@ -393,10 +393,10 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk, | |||
393 | bool slow; | 393 | bool slow; |
394 | 394 | ||
395 | if (flags & MSG_ERRQUEUE) | 395 | if (flags & MSG_ERRQUEUE) |
396 | return ipv6_recv_error(sk, msg, len); | 396 | return ipv6_recv_error(sk, msg, len, addr_len); |
397 | 397 | ||
398 | if (np->rxpmtu && np->rxopt.bits.rxpmtu) | 398 | if (np->rxpmtu && np->rxopt.bits.rxpmtu) |
399 | return ipv6_recv_rxpmtu(sk, msg, len); | 399 | return ipv6_recv_rxpmtu(sk, msg, len, addr_len); |
400 | 400 | ||
401 | try_again: | 401 | try_again: |
402 | skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0), | 402 | skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0), |
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c index cfd65304be60..d9b437e55007 100644 --- a/net/l2tp/l2tp_ip6.c +++ b/net/l2tp/l2tp_ip6.c | |||
@@ -665,7 +665,7 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk, | |||
665 | *addr_len = sizeof(*lsa); | 665 | *addr_len = sizeof(*lsa); |
666 | 666 | ||
667 | if (flags & MSG_ERRQUEUE) | 667 | if (flags & MSG_ERRQUEUE) |
668 | return ipv6_recv_error(sk, msg, len); | 668 | return ipv6_recv_error(sk, msg, len, addr_len); |
669 | 669 | ||
670 | skb = skb_recv_datagram(sk, flags, noblock, &err); | 670 | skb = skb_recv_datagram(sk, flags, noblock, &err); |
671 | if (!skb) | 671 | if (!skb) |