korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-12-26 12:34:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

net: Save and restore msg_namelen in sock_sendmsg

Browse Source 
[ Upstream commit 01b2885d94 ]

Commit 86a7e0b69b ("net: prevent rewrite of msg_name in
sock_sendmsg()") made sock_sendmsg save the incoming msg_name pointer
and restore it before returning, to insulate the caller against
msg_name being changed by the called code.  If the address length
was also changed however, we may return with an inconsistent structure
where the length doesn't match the address, and attempts to reuse it may
lead to lost packets.

For example, a kernel that doesn't have commit 1c5950fc6f ("udp6: fix
potential access to stale information") will replace a v4 mapped address
with its ipv4 equivalent, and shorten namelen accordingly from 28 to 16.
If the caller attempts to reuse the resulting msg structure, it will have
the original ipv6 (v4 mapped) address but an incorrect v4 length.

Fixes: 86a7e0b69b ("net: prevent rewrite of msg_name in sock_sendmsg()")
Signed-off-by: Marc Dionne <marc.dionne@auristor.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Marc Dionne 2023-12-21 09:12:30 -04:00 committed by Greg Kroah-Hartman
parent b2869e7600
commit 975d6f66f2
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
net/socket.c
View File

@ -728,6 +728,7 @@ int sock_sendmsg(struct socket *sock, struct msghdr *msg)
{ {
struct sockaddr_storage *save_addr = (struct sockaddr_storage *)msg->msg_name; struct sockaddr_storage *save_addr = (struct sockaddr_storage *)msg->msg_name;
struct sockaddr_storage address; struct sockaddr_storage address;
int save_len = msg->msg_namelen;
int ret; int ret;
if (msg->msg_name) { if (msg->msg_name) {
@ -737,6 +738,7 @@ int sock_sendmsg(struct socket *sock, struct msghdr *msg)
ret = __sock_sendmsg(sock, msg); ret = __sock_sendmsg(sock, msg);
msg->msg_name = save_addr; msg->msg_name = save_addr;
msg->msg_namelen = save_len;
return ret; return ret;
} }