From: Sasha Levin <[email protected]>
Date: Wed, 30 Jul 2014 09:21:08 -0400
> For raw sockets, we'd always assume that a header is supplied and will attempt
> to copy it into the ip header space using memcpy_fromiovecend():
>
> if (memcpy_fromiovecend((void *)iph, from, 0, length))
> goto error_free;
>
> The problem is that memcpy_fromiovecend() assumes that there are actual data
> to read from the iovec and doesn't deal with cases where there are none:
>
> int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
> int offset, int len)
> {
> /* Skip over the finished iovecs */
> while (offset >= iov->iov_len) {
> offset -= iov->iov_len;
> iov++;
> }
> [...]
>
> So when offset == 0 and iov->iov_len == 0, we'll just run iov into random
> kernel memory until it hits something bad and dies in a BUG/panic - either
> killing the kernel or leaking memory and held locks.
>
> Signed-off-by: Sasha Levin <[email protected]>
I sincerely think that memcpy_fromiovecend() is the part at fault here.
Defensively it should handle zero length copies, as memcpy_fromiovec()
right above it does.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
