net: clamp ->msg_namelen instead of returning an error
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 27 Nov 2013 12:40:21 +0000 (15:40 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 8 Dec 2013 15:29:25 +0000 (07:29 -0800)
commited47bba241c68cd39964dac3248e0a2962c8b7ff
treea364a68ed65e60605d86faee776a1a3cd003a809
parent08c62a109ed5f716556b2211f8cfd0d5fe6d18d2
net: clamp ->msg_namelen instead of returning an error

[ Upstream commit db31c55a6fb245fdbb752a2ca4aefec89afabb06 ]

If kmsg->msg_namelen > sizeof(struct sockaddr_storage) then in the
original code that would lead to memory corruption in the kernel if you
had audit configured.  If you didn't have audit configured it was
harmless.

There are some programs such as beta versions of Ruby which use too
large of a buffer and returning an error code breaks them.  We should
clamp the ->msg_namelen value instead.

Fixes: 1661bf364ae9 ("net: heap overflow in __audit_sockaddr()")
Reported-by: Eric Wong <normalperson@yhbt.net>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Tested-by: Eric Wong <normalperson@yhbt.net>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/compat.c
net/socket.c