lkml.org 
[lkml]   [2014]   [Jul]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] net: ipv4: raw: don't agree to 0 sized headers
From
From: Sasha Levin <sasha.levin@oracle.com>
Date: Wed, 30 Jul 2014 09:21:08 -0400

> For raw sockets, we'd always assume that a header is supplied and will attempt
> to copy it into the ip header space using memcpy_fromiovecend():
>
> if (memcpy_fromiovecend((void *)iph, from, 0, length))
> goto error_free;
>
> The problem is that memcpy_fromiovecend() assumes that there are actual data
> to read from the iovec and doesn't deal with cases where there are none:
>
> int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
> int offset, int len)
> {
> /* Skip over the finished iovecs */
> while (offset >= iov->iov_len) {
> offset -= iov->iov_len;
> iov++;
> }
> [...]
>
> So when offset == 0 and iov->iov_len == 0, we'll just run iov into random
> kernel memory until it hits something bad and dies in a BUG/panic - either
> killing the kernel or leaking memory and held locks.
>
> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>

I sincerely think that memcpy_fromiovecend() is the part at fault here.

Defensively it should handle zero length copies, as memcpy_fromiovec()
right above it does.


\
 
 \ /
  Last update: 2014-07-31 22:01    [W:0.035 / U:0.180 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site