diff options
| author | Andy Lutomirski <luto@amacapital.net> | 2013-05-22 14:07:44 -0700 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2013-06-29 04:06:39 +0100 |
| commit | 8beeb76aa534e9312fdae1c91ab3a2effc847ee5 (patch) | |
| tree | a33868acb4d129737472edca5c61e25b7173a56c /include | |
| parent | 94e7239c1bacb37ccddc3b32f3050780cab9d3d7 (diff) | |
| download | kernel-common-8beeb76aa534e9312fdae1c91ab3a2effc847ee5.tar.gz kernel-common-8beeb76aa534e9312fdae1c91ab3a2effc847ee5.tar.bz2 kernel-common-8beeb76aa534e9312fdae1c91ab3a2effc847ee5.zip | |
net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg
[ Upstream commits 1be374a0518a288147c6a7398792583200a67261 and
a7526eb5d06b0084ef12d7b168d008fcf516caab ]
MSG_CMSG_COMPAT is (AFAIK) not intended to be part of the API --
it's a hack that steals a bit to indicate to other networking code
that a compat entry was used. So don't allow it from a non-compat
syscall.
This prevents an oops when running this code:
int main()
{
int s;
struct sockaddr_in addr;
struct msghdr *hdr;
char *highpage = mmap((void*)(TASK_SIZE_MAX - 4096), 4096,
PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
if (highpage == MAP_FAILED)
err(1, "mmap");
s = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
if (s == -1)
err(1, "socket");
addr.sin_family = AF_INET;
addr.sin_port = htons(1);
addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
if (connect(s, (struct sockaddr*)&addr, sizeof(addr)) != 0)
err(1, "connect");
void *evil = highpage + 4096 - COMPAT_MSGHDR_SIZE;
printf("Evil address is %p\n", evil);
if (syscall(__NR_sendmmsg, s, evil, 1, MSG_CMSG_COMPAT) < 0)
err(1, "sendmmsg");
return 0;
}
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/socket.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/include/linux/socket.h b/include/linux/socket.h index 2acd2e20847e..7e9f2d325477 100644 --- a/include/linux/socket.h +++ b/include/linux/socket.h @@ -336,6 +336,9 @@ extern int put_cmsg(struct msghdr*, int level, int type, int len, void *data); struct timespec; +/* The __sys_...msg variants allow MSG_CMSG_COMPAT */ +extern long __sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags); +extern long __sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags); extern int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen, unsigned int flags, struct timespec *timeout); extern int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, |