Bug 205681 - recvmg is overwriting the buffer passed in msg_name by exceeding msg_namelen
Summary: recvmg is overwriting the buffer passed in msg_name by exceeding msg_namelen
Status: NEW
Alias: None
Product: Networking
Classification: Unclassified
Component: IPV4 (show other bugs)
Hardware: All Linux
: P1 high
Assignee: Stephen Hemminger
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-11-27 06:36 UTC by SREENIVASA SUDHEENDRA
Modified: 2019-11-28 05:05 UTC (History)
0 users

See Also:
Kernel Version: 5.4,4.0,3.0,2.6
Subsystem:
Regression: No
Bisected commit-id:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description SREENIVASA SUDHEENDRA 2019-11-27 06:36:50 UTC 
if (msg->msg_name) {
        struct sockaddr_rxrpc *srx = msg->msg_name;
        size_t len = sizeof(call->peer->srx);

        memcpy(msg->msg_name, &call->peer->srx, len);
        srx->srx_service = call->service_id;
        msg->msg_namelen = len;
    }


As seen, recvmsg is doing memcpy of len which can be greater than msg_namelen passed.
Comment 1 SREENIVASA SUDHEENDRA 2019-11-28 05:05:28 UTC 
I think I pointed to wrong piece of code.
My actual issue is, I pass msg_namelen as 16 to recvmsg, buffer ptr allocated with 16bytes in msg_name. Its overwriting two extra bytes and returing the msg_namelen as 18.
Note You need to log in before you can comment on or make changes to this bug.