Darkangeel_hd
/
lineage_android_kernel_samsung_jf
mirror of https://github.com/Darkangeel-hd/lineage_android_kernel_samsung_jf.git
1
0
Fork 0
Code Issues Releases Wiki Activity

net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg 

[ Upstream commits 1be374a0518a288147c6a7398792583200a67261 and
  a7526eb5d06b0084ef12d7b168d008fcf516caab ]

MSG_CMSG_COMPAT is (AFAIK) not intended to be part of the API --
it's a hack that steals a bit to indicate to other networking code
that a compat entry was used.  So don't allow it from a non-compat
syscall.

This prevents an oops when running this code:

int main()
{
	int s;
	struct sockaddr_in addr;
	struct msghdr *hdr;

	char *highpage = mmap((void*)(TASK_SIZE_MAX - 4096), 4096,
	                      PROT_READ | PROT_WRITE,
	                      MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
	if (highpage == MAP_FAILED)
		err(1, "mmap");

	s = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
	if (s == -1)
		err(1, "socket");

        addr.sin_family = AF_INET;
        addr.sin_port = htons(1);
        addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
	if (connect(s, (struct sockaddr*)&addr, sizeof(addr)) != 0)
		err(1, "connect");

	void *evil = highpage + 4096 - COMPAT_MSGHDR_SIZE;
	printf("Evil address is %p\n", evil);

	if (syscall(__NR_sendmmsg, s, evil, 1, MSG_CMSG_COMPAT) < 0)
		err(1, "sendmmsg");

	return 0;
}

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Andy Lutomirski 2013-05-22 14:07:44 -07:00 committed by Greg Kroah-Hartman
parent 3c353df4ca
commit c0cc94f2f6
3 changed files with 59 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
include/linux/socket.h
View File

@ -336,6 +336,9 @@ extern int put_cmsg(struct msghdr*, int level, int type, int len, void *data);
struct timespec; struct timespec;
/* The __sys_...msg variants allow MSG_CMSG_COMPAT */
extern long __sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags);
extern long __sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags);
extern int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen, extern int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
unsigned int flags, struct timespec *timeout); unsigned int flags, struct timespec *timeout);
extern int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, extern int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg,

13
net/compat.c
View File

@ -743,19 +743,25 @@ static unsigned char nas[21] = {
asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned flags) asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned flags)
{ {
return sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT); if (flags & MSG_CMSG_COMPAT)
return -EINVAL;
return __sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
} }
asmlinkage long compat_sys_sendmmsg(int fd, struct compat_mmsghdr __user *mmsg, asmlinkage long compat_sys_sendmmsg(int fd, struct compat_mmsghdr __user *mmsg,
unsigned vlen, unsigned int flags) unsigned vlen, unsigned int flags)
{ {
if (flags & MSG_CMSG_COMPAT)
return -EINVAL;
return __sys_sendmmsg(fd, (struct mmsghdr __user *)mmsg, vlen, return __sys_sendmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
flags | MSG_CMSG_COMPAT); flags | MSG_CMSG_COMPAT);
} }
asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags) asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags)
{ {
return sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT); if (flags & MSG_CMSG_COMPAT)
return -EINVAL;
return __sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
} }
asmlinkage long compat_sys_recv(int fd, void __user *buf, size_t len, unsigned flags) asmlinkage long compat_sys_recv(int fd, void __user *buf, size_t len, unsigned flags)
@ -777,6 +783,9 @@ asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
int datagrams; int datagrams;
struct timespec ktspec; struct timespec ktspec;
if (flags & MSG_CMSG_COMPAT)
return -EINVAL;
if (COMPAT_USE_64BIT_TIME) if (COMPAT_USE_64BIT_TIME)
return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen, return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
flags | MSG_CMSG_COMPAT, flags | MSG_CMSG_COMPAT,

67
net/socket.c
View File

@ -1899,9 +1899,9 @@ struct used_address {
unsigned int name_len; unsigned int name_len;
}; };
static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg, static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
struct msghdr *msg_sys, unsigned flags, struct msghdr *msg_sys, unsigned flags,
struct used_address *used_address) struct used_address *used_address)
{ {
struct compat_msghdr __user *msg_compat = struct compat_msghdr __user *msg_compat =
(struct compat_msghdr __user *)msg; (struct compat_msghdr __user *)msg;
@ -2017,22 +2017,30 @@ out:
* BSD sendmsg interface * BSD sendmsg interface
*/ */
SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned, flags) long __sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags)
{ {
int fput_needed, err; int fput_needed, err;
struct msghdr msg_sys; struct msghdr msg_sys;
struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed); struct socket *sock;
sock = sockfd_lookup_light(fd, &err, &fput_needed);
if (!sock) if (!sock)
goto out; goto out;
err = __sys_sendmsg(sock, msg, &msg_sys, flags, NULL); err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
fput_light(sock->file, fput_needed); fput_light(sock->file, fput_needed);
out: out:
return err; return err;
} }
SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
{
if (flags & MSG_CMSG_COMPAT)
return -EINVAL;
return __sys_sendmsg(fd, msg, flags);
}
/* /*
* Linux sendmmsg interface * Linux sendmmsg interface
*/ */
@ -2063,15 +2071,16 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
while (datagrams < vlen) { while (datagrams < vlen) {
if (MSG_CMSG_COMPAT & flags) { if (MSG_CMSG_COMPAT & flags) {
err = __sys_sendmsg(sock, (struct msghdr __user *)compat_entry, err = ___sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
&msg_sys, flags, &used_address); &msg_sys, flags, &used_address);
if (err < 0) if (err < 0)
break; break;
err = __put_user(err, &compat_entry->msg_len); err = __put_user(err, &compat_entry->msg_len);
++compat_entry; ++compat_entry;
} else { } else {
err = __sys_sendmsg(sock, (struct msghdr __user *)entry, err = ___sys_sendmsg(sock,
&msg_sys, flags, &used_address); (struct msghdr __user *)entry,
&msg_sys, flags, &used_address);
if (err < 0) if (err < 0)
break; break;
err = put_user(err, &entry->msg_len); err = put_user(err, &entry->msg_len);
@ -2095,11 +2104,13 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg, SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
unsigned int, vlen, unsigned int, flags) unsigned int, vlen, unsigned int, flags)
{ {
if (flags & MSG_CMSG_COMPAT)
return -EINVAL;
return __sys_sendmmsg(fd, mmsg, vlen, flags); return __sys_sendmmsg(fd, mmsg, vlen, flags);
} }
static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg, static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
struct msghdr *msg_sys, unsigned flags, int nosec) struct msghdr *msg_sys, unsigned flags, int nosec)
{ {
struct compat_msghdr __user *msg_compat = struct compat_msghdr __user *msg_compat =
(struct compat_msghdr __user *)msg; (struct compat_msghdr __user *)msg;
@ -2192,23 +2203,31 @@ out:
* BSD recvmsg interface * BSD recvmsg interface
*/ */
SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg, long __sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags)
unsigned int, flags)
{ {
int fput_needed, err; int fput_needed, err;
struct msghdr msg_sys; struct msghdr msg_sys;
struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed); struct socket *sock;
sock = sockfd_lookup_light(fd, &err, &fput_needed);
if (!sock) if (!sock)
goto out; goto out;
err = __sys_recvmsg(sock, msg, &msg_sys, flags, 0); err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
fput_light(sock->file, fput_needed); fput_light(sock->file, fput_needed);
out: out:
return err; return err;
} }
SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
unsigned int, flags)
{
if (flags & MSG_CMSG_COMPAT)
return -EINVAL;
return __sys_recvmsg(fd, msg, flags);
}
/* /*
* Linux recvmmsg interface * Linux recvmmsg interface
*/ */
@ -2246,17 +2265,18 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
* No need to ask LSM for more than the first datagram. * No need to ask LSM for more than the first datagram.
*/ */
if (MSG_CMSG_COMPAT & flags) { if (MSG_CMSG_COMPAT & flags) {
err = __sys_recvmsg(sock, (struct msghdr __user *)compat_entry, err = ___sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
&msg_sys, flags & ~MSG_WAITFORONE, &msg_sys, flags & ~MSG_WAITFORONE,
datagrams); datagrams);
if (err < 0) if (err < 0)
break; break;
err = __put_user(err, &compat_entry->msg_len); err = __put_user(err, &compat_entry->msg_len);
++compat_entry; ++compat_entry;
} else { } else {
err = __sys_recvmsg(sock, (struct msghdr __user *)entry, err = ___sys_recvmsg(sock,
&msg_sys, flags & ~MSG_WAITFORONE, (struct msghdr __user *)entry,
datagrams); &msg_sys, flags & ~MSG_WAITFORONE,
datagrams);
if (err < 0) if (err < 0)
break; break;
err = put_user(err, &entry->msg_len); err = put_user(err, &entry->msg_len);
@ -2323,6 +2343,9 @@ SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
int datagrams; int datagrams;
struct timespec timeout_sys; struct timespec timeout_sys;
if (flags & MSG_CMSG_COMPAT)
return -EINVAL;
if (!timeout) if (!timeout)
return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL); return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);