net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg
[ Upstream commits 1be374a0518a288147c6a7398792583200a67261 and a7526eb5d06b0084ef12d7b168d008fcf516caab ] MSG_CMSG_COMPAT is (AFAIK) not intended to be part of the API -- it's a hack that steals a bit to indicate to other networking code that a compat entry was used. So don't allow it from a non-compat syscall. This prevents an oops when running this code: int main() { int s; struct sockaddr_in addr; struct msghdr *hdr; char *highpage = mmap((void*)(TASK_SIZE_MAX - 4096), 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0); if (highpage == MAP_FAILED) err(1, "mmap"); s = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP); if (s == -1) err(1, "socket"); addr.sin_family = AF_INET; addr.sin_port = htons(1); addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); if (connect(s, (struct sockaddr*)&addr, sizeof(addr)) != 0) err(1, "connect"); void *evil = highpage + 4096 - COMPAT_MSGHDR_SIZE; printf("Evil address is %p\n", evil); if (syscall(__NR_sendmmsg, s, evil, 1, MSG_CMSG_COMPAT) < 0) err(1, "sendmmsg"); return 0; } Signed-off-by: Andy Lutomirski <luto@amacapital.net> Cc: David S. Miller <davem@davemloft.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
3c353df4ca
commit
c0cc94f2f6
|
@ -336,6 +336,9 @@ extern int put_cmsg(struct msghdr*, int level, int type, int len, void *data);
|
|||
|
||||
struct timespec;
|
||||
|
||||
/* The __sys_...msg variants allow MSG_CMSG_COMPAT */
|
||||
extern long __sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags);
|
||||
extern long __sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags);
|
||||
extern int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
|
||||
unsigned int flags, struct timespec *timeout);
|
||||
extern int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg,
|
||||
|
|
13
net/compat.c
13
net/compat.c
|
@ -743,19 +743,25 @@ static unsigned char nas[21] = {
|
|||
|
||||
asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned flags)
|
||||
{
|
||||
return sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
|
||||
if (flags & MSG_CMSG_COMPAT)
|
||||
return -EINVAL;
|
||||
return __sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
|
||||
}
|
||||
|
||||
asmlinkage long compat_sys_sendmmsg(int fd, struct compat_mmsghdr __user *mmsg,
|
||||
unsigned vlen, unsigned int flags)
|
||||
{
|
||||
if (flags & MSG_CMSG_COMPAT)
|
||||
return -EINVAL;
|
||||
return __sys_sendmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
|
||||
flags | MSG_CMSG_COMPAT);
|
||||
}
|
||||
|
||||
asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags)
|
||||
{
|
||||
return sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
|
||||
if (flags & MSG_CMSG_COMPAT)
|
||||
return -EINVAL;
|
||||
return __sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
|
||||
}
|
||||
|
||||
asmlinkage long compat_sys_recv(int fd, void __user *buf, size_t len, unsigned flags)
|
||||
|
@ -777,6 +783,9 @@ asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
|
|||
int datagrams;
|
||||
struct timespec ktspec;
|
||||
|
||||
if (flags & MSG_CMSG_COMPAT)
|
||||
return -EINVAL;
|
||||
|
||||
if (COMPAT_USE_64BIT_TIME)
|
||||
return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
|
||||
flags | MSG_CMSG_COMPAT,
|
||||
|
|
49
net/socket.c
49
net/socket.c
|
@ -1899,7 +1899,7 @@ struct used_address {
|
|||
unsigned int name_len;
|
||||
};
|
||||
|
||||
static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
|
||||
static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
|
||||
struct msghdr *msg_sys, unsigned flags,
|
||||
struct used_address *used_address)
|
||||
{
|
||||
|
@ -2017,22 +2017,30 @@ out:
|
|||
* BSD sendmsg interface
|
||||
*/
|
||||
|
||||
SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned, flags)
|
||||
long __sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags)
|
||||
{
|
||||
int fput_needed, err;
|
||||
struct msghdr msg_sys;
|
||||
struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
|
||||
struct socket *sock;
|
||||
|
||||
sock = sockfd_lookup_light(fd, &err, &fput_needed);
|
||||
if (!sock)
|
||||
goto out;
|
||||
|
||||
err = __sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
|
||||
err = ___sys_sendmsg(sock, msg, &msg_sys, flags, NULL);
|
||||
|
||||
fput_light(sock->file, fput_needed);
|
||||
out:
|
||||
return err;
|
||||
}
|
||||
|
||||
SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned int, flags)
|
||||
{
|
||||
if (flags & MSG_CMSG_COMPAT)
|
||||
return -EINVAL;
|
||||
return __sys_sendmsg(fd, msg, flags);
|
||||
}
|
||||
|
||||
/*
|
||||
* Linux sendmmsg interface
|
||||
*/
|
||||
|
@ -2063,14 +2071,15 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
|
|||
|
||||
while (datagrams < vlen) {
|
||||
if (MSG_CMSG_COMPAT & flags) {
|
||||
err = __sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
|
||||
err = ___sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
|
||||
&msg_sys, flags, &used_address);
|
||||
if (err < 0)
|
||||
break;
|
||||
err = __put_user(err, &compat_entry->msg_len);
|
||||
++compat_entry;
|
||||
} else {
|
||||
err = __sys_sendmsg(sock, (struct msghdr __user *)entry,
|
||||
err = ___sys_sendmsg(sock,
|
||||
(struct msghdr __user *)entry,
|
||||
&msg_sys, flags, &used_address);
|
||||
if (err < 0)
|
||||
break;
|
||||
|
@ -2095,10 +2104,12 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
|
|||
SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
|
||||
unsigned int, vlen, unsigned int, flags)
|
||||
{
|
||||
if (flags & MSG_CMSG_COMPAT)
|
||||
return -EINVAL;
|
||||
return __sys_sendmmsg(fd, mmsg, vlen, flags);
|
||||
}
|
||||
|
||||
static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
|
||||
static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
|
||||
struct msghdr *msg_sys, unsigned flags, int nosec)
|
||||
{
|
||||
struct compat_msghdr __user *msg_compat =
|
||||
|
@ -2192,23 +2203,31 @@ out:
|
|||
* BSD recvmsg interface
|
||||
*/
|
||||
|
||||
SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
|
||||
unsigned int, flags)
|
||||
long __sys_recvmsg(int fd, struct msghdr __user *msg, unsigned flags)
|
||||
{
|
||||
int fput_needed, err;
|
||||
struct msghdr msg_sys;
|
||||
struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
|
||||
struct socket *sock;
|
||||
|
||||
sock = sockfd_lookup_light(fd, &err, &fput_needed);
|
||||
if (!sock)
|
||||
goto out;
|
||||
|
||||
err = __sys_recvmsg(sock, msg, &msg_sys, flags, 0);
|
||||
err = ___sys_recvmsg(sock, msg, &msg_sys, flags, 0);
|
||||
|
||||
fput_light(sock->file, fput_needed);
|
||||
out:
|
||||
return err;
|
||||
}
|
||||
|
||||
SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
|
||||
unsigned int, flags)
|
||||
{
|
||||
if (flags & MSG_CMSG_COMPAT)
|
||||
return -EINVAL;
|
||||
return __sys_recvmsg(fd, msg, flags);
|
||||
}
|
||||
|
||||
/*
|
||||
* Linux recvmmsg interface
|
||||
*/
|
||||
|
@ -2246,7 +2265,7 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
|
|||
* No need to ask LSM for more than the first datagram.
|
||||
*/
|
||||
if (MSG_CMSG_COMPAT & flags) {
|
||||
err = __sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
|
||||
err = ___sys_recvmsg(sock, (struct msghdr __user *)compat_entry,
|
||||
&msg_sys, flags & ~MSG_WAITFORONE,
|
||||
datagrams);
|
||||
if (err < 0)
|
||||
|
@ -2254,7 +2273,8 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
|
|||
err = __put_user(err, &compat_entry->msg_len);
|
||||
++compat_entry;
|
||||
} else {
|
||||
err = __sys_recvmsg(sock, (struct msghdr __user *)entry,
|
||||
err = ___sys_recvmsg(sock,
|
||||
(struct msghdr __user *)entry,
|
||||
&msg_sys, flags & ~MSG_WAITFORONE,
|
||||
datagrams);
|
||||
if (err < 0)
|
||||
|
@ -2323,6 +2343,9 @@ SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
|
|||
int datagrams;
|
||||
struct timespec timeout_sys;
|
||||
|
||||
if (flags & MSG_CMSG_COMPAT)
|
||||
return -EINVAL;
|
||||
|
||||
if (!timeout)
|
||||
return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
|
||||
|
||||
|
|
Loading…
Reference in New Issue