aboutsummaryrefslogtreecommitdiffstats
path: root/tools/perf/CREDITS
diff options
context:
space:
mode:
authorAndy Lutomirski <luto@amacapital.net>2013-05-22 14:07:44 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-06-27 10:34:32 -0700
commite1b796f9408a33d18709e9fdbf18ce91dfede962 (patch)
treecd2770c50c0f4c20deee94165eb72587316c1c92 /tools/perf/CREDITS
parent34e4c0aed353934a72809784999900fc7b5653ef (diff)
downloadkernel_samsung_aries-e1b796f9408a33d18709e9fdbf18ce91dfede962.zip
kernel_samsung_aries-e1b796f9408a33d18709e9fdbf18ce91dfede962.tar.gz
kernel_samsung_aries-e1b796f9408a33d18709e9fdbf18ce91dfede962.tar.bz2
net: Block MSG_CMSG_COMPAT in send(m)msg and recv(m)msg
[ Upstream commits 1be374a0518a288147c6a7398792583200a67261 and a7526eb5d06b0084ef12d7b168d008fcf516caab ] MSG_CMSG_COMPAT is (AFAIK) not intended to be part of the API -- it's a hack that steals a bit to indicate to other networking code that a compat entry was used. So don't allow it from a non-compat syscall. This prevents an oops when running this code: int main() { int s; struct sockaddr_in addr; struct msghdr *hdr; char *highpage = mmap((void*)(TASK_SIZE_MAX - 4096), 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0); if (highpage == MAP_FAILED) err(1, "mmap"); s = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP); if (s == -1) err(1, "socket"); addr.sin_family = AF_INET; addr.sin_port = htons(1); addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); if (connect(s, (struct sockaddr*)&addr, sizeof(addr)) != 0) err(1, "connect"); void *evil = highpage + 4096 - COMPAT_MSGHDR_SIZE; printf("Evil address is %p\n", evil); if (syscall(__NR_sendmmsg, s, evil, 1, MSG_CMSG_COMPAT) < 0) err(1, "sendmmsg"); return 0; } Cc: David S. Miller <davem@davemloft.net> Signed-off-by: Andy Lutomirski <luto@amacapital.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'tools/perf/CREDITS')
0 files changed, 0 insertions, 0 deletions