linux/net/sctp
Tommi Rantala 6e51fe7572 sctp: fix -ENOMEM result with invalid user space pointer in sendto() syscall
Consider the following program, that sets the second argument to the
sendto() syscall incorrectly:

 #include <string.h>
 #include <arpa/inet.h>
 #include <sys/socket.h>

 int main(void)
 {
         int fd;
         struct sockaddr_in sa;

         fd = socket(AF_INET, SOCK_STREAM, 132 /*IPPROTO_SCTP*/);
         if (fd < 0)
                 return 1;

         memset(&sa, 0, sizeof(sa));
         sa.sin_family = AF_INET;
         sa.sin_addr.s_addr = inet_addr("127.0.0.1");
         sa.sin_port = htons(11111);

         sendto(fd, NULL, 1, 0, (struct sockaddr *)&sa, sizeof(sa));

         return 0;
 }

We get -ENOMEM:

 $ strace -e sendto ./demo
 sendto(3, NULL, 1, 0, {sa_family=AF_INET, sin_port=htons(11111), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 ENOMEM (Cannot allocate memory)

Propagate the error code from sctp_user_addto_chunk(), so that we will
tell user space what actually went wrong:

 $ strace -e sendto ./demo
 sendto(3, NULL, 1, 0, {sa_family=AF_INET, sin_port=htons(11111), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 EFAULT (Bad address)

Noticed while running Trinity (the syscall fuzzer).

Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-11-28 11:11:17 -05:00
..
associola.c sctp: Make sysctl tunables per net 2012-08-14 23:32:16 -07:00
auth.c sctp: fix bogus if statement in sctp_auth_recv_cid() 2012-08-16 13:36:29 -07:00
bind_addr.c sctp: Make sysctl tunables per net 2012-08-14 23:32:16 -07:00
chunk.c sctp: fix -ENOMEM result with invalid user space pointer in sendto() syscall 2012-11-28 11:11:17 -05:00
command.c [SCTP]: Remove sctp_add_cmd_sf wrapper bloat 2008-03-27 17:54:29 -07:00
debug.c sctp: remove completely unsed EMPTY state 2011-04-20 01:51:03 -07:00
endpointola.c sctp: Make sysctl tunables per net 2012-08-14 23:32:16 -07:00
input.c sctp: fix a typo in prototype of __sctp_rcv_lookup() 2012-10-04 15:53:48 -04:00
inqueue.c net/sctp: Use pr_fmt and pr_<level> 2010-08-26 14:11:48 -07:00
ipv6.c sctp: Make the mib per network namespace 2012-08-14 23:30:36 -07:00
Kconfig sctp: implement sctp association probing module 2010-04-30 22:41:09 -04:00
Makefile sctp: implement sctp association probing module 2010-04-30 22:41:09 -04:00
objcnt.c sctp: Make the proc files per network namespace. 2012-08-14 23:29:53 -07:00
output.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2012-09-15 11:43:53 -04:00
outqueue.c sctp: check src addr when processing SACK to update transport state 2012-10-04 15:53:48 -04:00
primitive.c sctp: Push struct net down to sctp_chunk_event_lookup 2012-08-14 23:30:37 -07:00
probe.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6 2010-10-23 11:47:02 -07:00
proc.c sctp: fix /proc/net/sctp/ memory leak 2012-11-15 13:56:05 -05:00
protocol.c sctp: Make sysctl tunables per net 2012-08-14 23:32:16 -07:00
sm_make_chunk.c sctp: Make sysctl tunables per net 2012-08-14 23:32:16 -07:00
sm_sideeffect.c sctp: fix call to SCTP_CMD_PROCESS_SACK in sctp_cmd_interpreter() 2012-10-16 14:41:46 -04:00
sm_statefuns.c sctp: check src addr when processing SACK to update transport state 2012-10-04 15:53:48 -04:00
sm_statetable.c sctp: Make sysctl tunables per net 2012-08-14 23:32:16 -07:00
socket.c sctp: fix -ENOMEM result with invalid user space pointer in sendto() syscall 2012-11-28 11:11:17 -05:00
ssnmap.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
sysctl.c sctp: Make sysctl tunables per net 2012-08-14 23:32:16 -07:00
transport.c sctp: Make sysctl tunables per net 2012-08-14 23:32:16 -07:00
tsnmap.c sctp: be more restrictive in transport selection on bundled sacks 2012-06-30 22:44:35 -07:00
ulpevent.c netvm: prevent a stream-specific deadlock 2012-07-31 18:42:47 -07:00
ulpqueue.c sctp: Make the mib per network namespace 2012-08-14 23:30:36 -07:00