lkml.org 
[lkml]   [2014]   [Jul]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: net: socket: NULL ptr deref in sendmsg
    From
    2014-07-26 0:52 GMT+04:00 Sasha Levin <sasha.levin@oracle.com>:
    > On 07/25/2014 11:23 AM, Andrey Ryabinin wrote:
    >> After this report there was no usual "Unable to handle kernel NULL pointer dereference"
    >> and this gave me a clue that address 0 is mapped and contains valid socket address structure in it.
    >
    > Interesting. Does it mean that all network protocols that check it for being NULL instead of checking
    > the length are incorrect?
    >

    I think they are correct. After verify_iovec() we should have either
    both msg->msg_name == 0 and msg->msg_namelen == 0,
    or both != 0 (and msg_name should be a kernel address).

    That bug allows to leave verify_iovec() with msg_namelen > 0 and
    msg_name == NULL, causing troubles for protocols checking only
    msg_namelen.

    > (such as:)
    >
    > if (msg->msg_name) {
    > DECLARE_SOCKADDR(struct sockaddr_can *, addr, msg->msg_name);
    >
    > [...]
    >
    >
    > Thanks,
    > Sasha
    >

    --
    Best regards,
    Andrey Ryabinin


    \
     
     \ /
      Last update: 2014-07-26 18:21    [W:2.220 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site