Thread (16 messages) 16 messages, 8 authors, 2013-11-29

Re: [patch] net: clamp ->msg_namelen instead of returning an error

From: Eric Wong <hidden>
Date: 2013-11-27 19:42:47

Dan Carpenter [off-list ref] wrote:
If kmsg->msg_namelen > sizeof(struct sockaddr_storage) then in the
original code that would lead to memory corruption in the kernel if you
had audit configured.  If you didn't have audit configured it was
harmless.

There are some programs such as beta versions of Ruby which use too
large of a buffer and returning an error code breaks them.  We should
clamp the ->msg_namelen value instead.

Reported-by: Eric Wong <redacted>
Thanks Dan, Ruby trunk r43886 works out-of-the-box with this fix.
Dave: please queue for stable, thanks

Tested-by: Eric Wong <redacted>
Signed-off-by: Dan Carpenter <redacted>
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help