Messages in this thread Patch in this message | | | From | Yann Droneaud <> | Subject | [PATCH] af_unix: Escape abstract unix socket address | Date | Wed, 6 Apr 2022 12:22:13 +0200 |
| |
Abstract unix socket address are bytes sequences up to 108 bytes (UNIX_PATH_MAX == sizeof(struct sockaddr_un) - offsetof(struct sockaddr_un, sun_path)).
As with any random string of bytes, printing them in /proc/net/unix should be done with caution to prevent misbehavior.
It would have been great to use seq_escape_mem() to escape the control characters in a reversible way.
Unfortunately userspace might expect that NUL bytes are replaced with '@' characters as it's done currently.
So this patch implements the following scheme: any control characters, including NUL, in the abstract unix socket addresses is replaced by '@' characters.
Sadly, with such non reversible escape scheme, abstract addresses such as "\0\0", "\0\a", "\0\b", "\0\t", etc. will have the same representation: "@@".
But will prevent "cat /proc/net/unix" from messing with terminal, and will prevent "\n" in abstract address from messing with parsing the list of Unix sockets.
Signed-off-by: Yann Droneaud <ydroneaud@opteya.com> --- net/unix/af_unix.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index e71a312faa1e..8021efd92301 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -3340,7 +3340,8 @@ static int unix_seq_show(struct seq_file *seq, void *v) i++; } for ( ; i < len; i++) - seq_putc(seq, u->addr->name->sun_path[i] ?: + seq_putc(seq, !iscntrl(u->addr->name->sun_path[i]) ? + u->addr->name->sun_path[i] : '@'); } unix_state_unlock(s); -- 2.32.0
| |