From: Andrey Ryabinin <ryabinin....@gmail.com> Date: Sat, 26 Jul 2014 21:26:58 +0400
> Sasha's report: ... > This reports means that we've come to netlink_sendmsg() with msg->msg_name == > NULL and msg->msg_namelen > 0. > > After this report there was no usual "Unable to handle kernel NULL pointer > dereference" > and this gave me a clue that address 0 is mapped and contains valid socket > address structure in it. > > This bug was introduced in f3d3342602f8bcbf37d7c46641cb9bca7618eb1c > (net: rework recvmsg handler msg_name and msg_namelen logic). > Commit message states that: > "Set msg->msg_name = NULL if user specified a NULL in msg_name but had a > non-null msg_namelen in verify_iovec/verify_compat_iovec. This doesn't > affect sendto as it would bail out earlier while trying to copy-in the > address." > But in fact this affects sendto when address 0 is mapped and contains > socket address structure in it. In such case copy-in address will succeed, > verify_iovec() function will successfully exit with msg->msg_namelen > 0 > and msg->msg_name == NULL. > > This patch fixes it by setting msg_namelen to 0 if msg_name == NULL. > > Cc: Hannes Frederic Sowa <han...@stressinduktion.org> > Cc: Eric Dumazet <eduma...@google.com> > Cc: <sta...@vger.kernel.org> > Reported-by: Sasha Levin <sasha.le...@oracle.com> > Signed-off-by: Andrey Ryabinin <a.ryabi...@samsung.com> Applied and queued up for -stable, thanks! -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
