* [PATCH] Fix memory overwriting issue when copy an address to user space
@ 2020-07-20 4:34 lebon zhou
2020-07-20 15:12 ` David Laight
0 siblings, 1 reply; 6+ messages in thread
From: lebon zhou @ 2020-07-20 4:34 UTC (permalink / raw)
To: davem, kuba; +Cc: linux-kernel, netdev
When application provided buffer size less than sockaddr_storage, then
kernel will overwrite some memory area which may cause memory corruption,
e.g.: in recvmsg case, let msg_name=malloc(8) and msg_namelen=8, then
usually application can call recvmsg successful but actually application
memory get corrupted.
Fix to return EINVAL when application buffer size less than
sockaddr_storage.
Signed-off-by: lebon.zhou <lebon.zhou@gmail.com>
---
net/socket.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/socket.c b/net/socket.c
index 976426d03f09..dc32b1b899df 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -229,7 +229,7 @@ static int move_addr_to_user(struct
sockaddr_storage *kaddr, int klen,
return err;
if (len > klen)
len = klen;
- if (len < 0)
+ if (len < 0 || len < klen)
return -EINVAL;
if (len) {
if (audit_sockaddr(klen, kaddr))
--
2.22.0
^ permalink raw reply [flat|nested] 6+ messages in thread* RE: [PATCH] Fix memory overwriting issue when copy an address to user space
2020-07-20 4:34 [PATCH] Fix memory overwriting issue when copy an address to user space lebon zhou
@ 2020-07-20 15:12 ` David Laight
2020-07-21 4:23 ` lebon zhou
0 siblings, 1 reply; 6+ messages in thread
From: David Laight @ 2020-07-20 15:12 UTC (permalink / raw)
To: 'lebon zhou', davem, kuba; +Cc: linux-kernel, netdev
From: lebon zhou
> Sent: 20 July 2020 05:35
> To: davem@davemloft.net; kuba@kernel.org
> Cc: linux-kernel@vger.kernel.org; netdev@vger.kernel.org
> Subject: [PATCH] Fix memory overwriting issue when copy an address to user space
>
> When application provided buffer size less than sockaddr_storage, then
> kernel will overwrite some memory area which may cause memory corruption,
> e.g.: in recvmsg case, let msg_name=malloc(8) and msg_namelen=8, then
> usually application can call recvmsg successful but actually application
> memory get corrupted.
Where?
The copy_to_user() uses the short length provided by the user.
There is even a comment saying that if the address is truncated
the length returned to the user is the full length.
Maybe the application is reusing the msg without re-initialising
it properly.
David
-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] Fix memory overwriting issue when copy an address to user space
2020-07-20 15:12 ` David Laight
@ 2020-07-21 4:23 ` lebon zhou
0 siblings, 0 replies; 6+ messages in thread
From: lebon zhou @ 2020-07-21 4:23 UTC (permalink / raw)
To: David Laight; +Cc: davem, kuba, linux-kernel, netdev
On Mon, Jul 20, 2020 at 11:12 PM David Laight <David.Laight@aculab.com> wrote:
>
> From: lebon zhou
> > Sent: 20 July 2020 05:35
> > To: davem@davemloft.net; kuba@kernel.org
> > Cc: linux-kernel@vger.kernel.org; netdev@vger.kernel.org
> > Subject: [PATCH] Fix memory overwriting issue when copy an address to user space
> >
> > When application provided buffer size less than sockaddr_storage, then
> > kernel will overwrite some memory area which may cause memory corruption,
> > e.g.: in recvmsg case, let msg_name=malloc(8) and msg_namelen=8, then
> > usually application can call recvmsg successful but actually application
> > memory get corrupted.
>
> Where?
> The copy_to_user() uses the short length provided by the user.
> There is even a comment saying that if the address is truncated
> the length returned to the user is the full length.
>
> Maybe the application is reusing the msg without re-initialising
> it properly.
It is not related with copy_to_user(), it is about move_addr_to_user()
implementation itself,
there is comment /*After copying the data up to the limit the user
specifies...*/, but the fact
is when (ulen < klen), this function will copy more content to user
buffer over than user
specifies in @ulen, this will cause the user buffer to corrupt, this
patch fixes this issue.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] Fix memory overwriting issue when copy an address to user space
@ 2020-07-17 10:31 lebon zhou
2020-07-17 17:50 ` Jakub Kicinski
2020-07-18 1:43 ` David Miller
0 siblings, 2 replies; 6+ messages in thread
From: lebon zhou @ 2020-07-17 10:31 UTC (permalink / raw)
To: davem, kuba; +Cc: linux-kernel
When application provided buffer size less than sockaddr_storage, then
kernel will overwrite some memory area which may cause memory corruption,
e.g.: in recvmsg case, let msg_name=malloc(8) and msg_namelen=8, then
usually application can call recvmsg successful but actually application
memory get corrupted.
Fix to return EINVAL when application buffer size less than
sockaddr_storage.
Signed-off-by: lebon.zhou <lebon.zhou@gmail.com>
---
net/socket.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/socket.c b/net/socket.c
index 976426d03f09..dc32b1b899df 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -229,7 +229,7 @@ static int move_addr_to_user(struct
sockaddr_storage *kaddr, int klen,
return err;
if (len > klen)
len = klen;
- if (len < 0)
+ if (len < 0 || len < klen)
return -EINVAL;
if (len) {
if (audit_sockaddr(klen, kaddr))
--
2.22.0
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] Fix memory overwriting issue when copy an address to user space
2020-07-17 10:31 lebon zhou
@ 2020-07-17 17:50 ` Jakub Kicinski
2020-07-18 1:43 ` David Miller
1 sibling, 0 replies; 6+ messages in thread
From: Jakub Kicinski @ 2020-07-17 17:50 UTC (permalink / raw)
To: lebon zhou; +Cc: davem, linux-kernel
On Fri, 17 Jul 2020 10:31:54 +0000 lebon zhou wrote:
> When application provided buffer size less than sockaddr_storage, then
> kernel will overwrite some memory area which may cause memory corruption,
> e.g.: in recvmsg case, let msg_name=malloc(8) and msg_namelen=8, then
> usually application can call recvmsg successful but actually application
> memory get corrupted.
>
> Fix to return EINVAL when application buffer size less than
> sockaddr_storage.
>
> Signed-off-by: lebon.zhou <lebon.zhou@gmail.com>
Please repoist CCing the netdev mailing list.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] Fix memory overwriting issue when copy an address to user space
2020-07-17 10:31 lebon zhou
2020-07-17 17:50 ` Jakub Kicinski
@ 2020-07-18 1:43 ` David Miller
1 sibling, 0 replies; 6+ messages in thread
From: David Miller @ 2020-07-18 1:43 UTC (permalink / raw)
To: lebon.zhou; +Cc: kuba, linux-kernel
From: lebon zhou <lebon.zhou@gmail.com>
Date: Fri, 17 Jul 2020 10:31:54 +0000
> When application provided buffer size less than sockaddr_storage, then
> kernel will overwrite some memory area which may cause memory corruption,
> e.g.: in recvmsg case, let msg_name=malloc(8) and msg_namelen=8, then
> usually application can call recvmsg successful but actually application
> memory get corrupted.
>
> Fix to return EINVAL when application buffer size less than
> sockaddr_storage.
>
> Signed-off-by: lebon.zhou <lebon.zhou@gmail.com>
Please post networking fixes to netdev@vger.kernel.org
Thank you.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-07-21 3:26 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-20 4:34 [PATCH] Fix memory overwriting issue when copy an address to user space lebon zhou
2020-07-20 15:12 ` David Laight
2020-07-21 4:23 ` lebon zhou
-- strict thread matches above, loose matches on Subject: below --
2020-07-17 10:31 lebon zhou
2020-07-17 17:50 ` Jakub Kicinski
2020-07-18 1:43 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®