inet: prevent leakage of uninitialized memory to user in recv syscalls
Only update *addr_len when we actually fill in sockaddr, otherwise we can return uninitialized memory from the stack to the caller in the recvfrom, recvmmsg and recvmsg syscalls. Drop the the (addr_len == NULL) checks because we only get called with a valid addr_len pointer either from sock_common_recvmsg or inet_recvmsg. If a blocking read waits on a socket which is concurrently shut down we now return zero and set msg_msgnamelen to 0. Reported-by:mpb <mpb.mail@gmail.com> Suggested-by:
Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by:
Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by:
David S. Miller <davem@davemloft.net>
Showing
- net/ieee802154/dgram.c 1 addition, 2 deletionsnet/ieee802154/dgram.c
- net/ipv4/ping.c 7 additions, 12 deletionsnet/ipv4/ping.c
- net/ipv4/raw.c 1 addition, 3 deletionsnet/ipv4/raw.c
- net/ipv4/udp.c 1 addition, 6 deletionsnet/ipv4/udp.c
- net/ipv6/raw.c 1 addition, 3 deletionsnet/ipv6/raw.c
- net/ipv6/udp.c 1 addition, 4 deletionsnet/ipv6/udp.c
- net/l2tp/l2tp_ip.c 1 addition, 3 deletionsnet/l2tp/l2tp_ip.c
- net/phonet/datagram.c 4 additions, 5 deletionsnet/phonet/datagram.c
Loading
Please register or sign in to comment