Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8e9f6bdb authored by Willem de Bruijn's avatar Willem de Bruijn Committed by Greg Kroah-Hartman
Browse files

ip: zero sockaddr returned on error queue 



[ Upstream commit f812116b174e59a350acc8e4856213a166a91222 ]

The sockaddr is returned in IP(V6)_RECVERR as part of errhdr. That
structure is defined and allocated on the stack as

    struct {
            struct sock_extended_err ee;
            struct sockaddr_in(6)    offender;
    } errhdr;

The second part is only initialized for certain SO_EE_ORIGIN values.
Always initialize it completely.

An MTU exceeded error on a SOCK_RAW/IPPROTO_RAW is one example that
would return uninitialized bytes.

Signed-off-by: default avatarWillem de Bruijn <willemb@google.com>

----

Also verified that there is no padding between errhdr.ee and
errhdr.offender that could leak additional kernel data.
Acked-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a17f9bf1

net/ipv4/ip_sockglue.c

+2 −6
Original line number Diff line number Diff line
@@ -443,15 +443,11 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) 


	memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));

	sin = &errhdr.offender;

	sin->sin_family = AF_UNSPEC;

	memset(sin, 0, sizeof(*sin));

	if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP) {

		struct inet_sock *inet = inet_sk(sk);



		sin->sin_family = AF_INET;

		sin->sin_addr.s_addr = ip_hdr(skb)->saddr;

		sin->sin_port = 0;

		memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));

		if (inet->cmsg_flags)

		if (inet_sk(sk)->cmsg_flags)

			ip_cmsg_recv(msg, skb);

	}

net/ipv6/datagram.c

+3 −7
Original line number Diff line number Diff line
@@ -383,11 +383,10 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) 


	memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));

	sin = &errhdr.offender;

	sin->sin6_family = AF_UNSPEC;

	memset(sin, 0, sizeof(*sin));



	if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL) {

		sin->sin6_family = AF_INET6;

		sin->sin6_flowinfo = 0;

		sin->sin6_port = 0;

		if (np->rxopt.all)

			ip6_datagram_recv_common_ctl(sk, msg, skb);

		if (skb->protocol == htons(ETH_P_IPV6)) {
@@ -398,12 +397,9 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) 
				ipv6_iface_scope_id(&sin->sin6_addr,

						    IP6CB(skb)->iif);

		} else {

			struct inet_sock *inet = inet_sk(sk);



			ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,

					       &sin->sin6_addr);

			sin->sin6_scope_id = 0;

			if (inet->cmsg_flags)

			if (inet_sk(sk)->cmsg_flags)

				ip_cmsg_recv(msg, skb);

		}

	}