lkml.org 
[lkml]   [2010]   [Dec]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH] [210/223] econet: disallow NULL remote addr for sendmsg(), fixes CVE-2010-3849
    Date
    2.6.35-longterm review patch.  If anyone has any objections, please let me know.

    ------------------
    From: Phil Blundell <philb@gnu.org>

    commit fa0e846494792e722d817b9d3d625a4ef4896c96 upstream.

    Later parts of econet_sendmsg() rely on saddr != NULL, so return early
    with EINVAL if NULL was passed otherwise an oops may occur.

    Signed-off-by: Phil Blundell <philb@gnu.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andi Kleen <ak@linux.intel.com>

    ---
    net/econet/af_econet.c | 26 ++++++++------------------
    1 file changed, 8 insertions(+), 18 deletions(-)

    Index: linux/net/econet/af_econet.c
    ===================================================================
    --- linux.orig/net/econet/af_econet.c
    +++ linux/net/econet/af_econet.c
    @@ -297,23 +297,14 @@ static int econet_sendmsg(struct kiocb *

    mutex_lock(&econet_mutex);

    - if (saddr == NULL) {
    - struct econet_sock *eo = ec_sk(sk);
    -
    - addr.station = eo->station;
    - addr.net = eo->net;
    - port = eo->port;
    - cb = eo->cb;
    - } else {
    - if (msg->msg_namelen < sizeof(struct sockaddr_ec)) {
    - mutex_unlock(&econet_mutex);
    - return -EINVAL;
    - }
    - addr.station = saddr->addr.station;
    - addr.net = saddr->addr.net;
    - port = saddr->port;
    - cb = saddr->cb;
    - }
    + if (saddr == NULL || msg->msg_namelen < sizeof(struct sockaddr_ec)) {
    + mutex_unlock(&econet_mutex);
    + return -EINVAL;
    + }
    + addr.station = saddr->addr.station;
    + addr.net = saddr->addr.net;
    + port = saddr->port;
    + cb = saddr->cb;

    /* Look for a device with the right network number. */
    dev = net2dev_map[addr.net];
    @@ -351,7 +342,6 @@ static int econet_sendmsg(struct kiocb *

    eb = (struct ec_cb *)&skb->cb;

    - /* BUG: saddr may be NULL */
    eb->cookie = saddr->cookie;
    eb->sec = *saddr;
    eb->sent = ec_tx_done;

    \
     
     \ /
      Last update: 2010-12-13 01:13    [W:0.038 / U:0.164 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site