net: clamp ->msg_namelen instead of returning an error
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 27 Nov 2013 12:40:21 +0000 (15:40 +0300)
committerDavid S. Miller <davem@davemloft.net>
Fri, 29 Nov 2013 21:12:52 +0000 (16:12 -0500)
commitdb31c55a6fb245fdbb752a2ca4aefec89afabb06
treeab94a0065aaa0db14bdca1ae6c92b6e29a086165
parentec6f809ff6f19fafba3212f6aff0dda71dfac8e8
net: clamp ->msg_namelen instead of returning an error

If kmsg->msg_namelen > sizeof(struct sockaddr_storage) then in the
original code that would lead to memory corruption in the kernel if you
had audit configured.  If you didn't have audit configured it was
harmless.

There are some programs such as beta versions of Ruby which use too
large of a buffer and returning an error code breaks them.  We should
clamp the ->msg_namelen value instead.

Fixes: 1661bf364ae9 ("net: heap overflow in __audit_sockaddr()")
Reported-by: Eric Wong <normalperson@yhbt.net>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Tested-by: Eric Wong <normalperson@yhbt.net>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/compat.c
net/socket.c