From: Weiping Pan <[email protected]> Date: Mon, 23 Jul 2012 10:37:48 +0800
> Jay Fenlason ([email protected]) found a bug, > that recvfrom() on an RDS socket can return the contents of random kernel > memory to userspace if it was called with a address length larger than > sizeof(struct sockaddr_in). > rds_recvmsg() also fails to set the addr_len paramater properly before > returning, but that's just a bug. > There are also a number of cases wher recvfrom() can return an entirely bogus > address. Anything in rds_recvmsg() that returns a non-negative value but does > not go through the "sin = (struct sockaddr_in *)msg->msg_name;" code path > at the end of the while(1) loop will return up to 128 bytes of kernel memory > to userspace. > > And I write two test programs to reproduce this bug, you will see that in > rds_server, fromAddr will be overwritten and the following sock_fd will be > destroyed. > Yes, it is the programmer's fault to set msg_namelen incorrectly, but it is > better to make the kernel copy the real length of address to user space in > such case. > > How to run the test programs ? > I test them on 32bit x86 system, 3.5.0-rc7. ... > Signed-off-by: Weiping Pan <[email protected]> Applied, thanks. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
