lkml.org 
[lkml]   [2006]   [Aug]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [PATCH] getsockopt() early argument sanity checking
    From
    Hello.

    In article <20060820101528.GE602@1wt.eu> (at Sun, 20 Aug 2006 12:15:28 +0200), Willy Tarreau <w@1wt.eu> says:

    > But I don't want to induce such large changes in this kernel. The goal of
    > this test is a preventive measure to catch easily exploitable errors that
    > might have remained undetected. For instance, a quick glance shows this
    > portion of code in net/ipv4/raw.c (both 2.4 and 2.6) :
    >
    > static int raw_seticmpfilter(struct sock *sk, char *optval, int optlen)
    > {
    > if (optlen > sizeof(struct icmp_filter))
    > optlen = sizeof(struct icmp_filter);
    > if (copy_from_user(&sk->tp_pinfo.tp_raw4.filter, optval, optlen))
    > return -EFAULT;
    > return 0;
    > }
    >
    > It only relies on sock_setsockopt() refusing optlen values < sizeof(int),
    > and this is not documented. Having part of this code being copied for use
    > in another code path would open a breach for optlen < 0.
    :
    > There are two tests in this patch :
    >
    > - one on the validity of the optlen address. This one is race-free and
    > should be conserved anyway.
    >
    > - one on the optlen range which is valid for most cases but which is
    > subject to a race condition and which might be circumvented by
    > carefully written code and with some luck as in all race conditions
    > issues.

    Don't mix getsockopt() and setsockopt() code paths.

    For setsockopt(), optlen < 0 is checked in net/socket.c:sys_setsockopt().

    For getsockopt(), optlen and *optlen < 0 is (and should be) checked
    (or handled) in each getsockopt function; e.g. do_ip_getsockopt(),
    raw_geticmpfilter() etc.

    --yoshfuji
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2006-08-20 12:51    [W:4.690 / U:0.132 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site