This is a note to let you know that I've just added the patch titled
net: validate the range we feed to iov_iter_init() in sys_sendto/sys_recvfrom
to the 3.19-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
net-validate-the-range-we-feed-to-iov_iter_init-in-sys_sendto-sys_recvfrom.patch
and it can be found in the queue-3.19 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 4de930efc23b92ddf88ce91c405ee645fe6e27ea Mon Sep 17 00:00:00 2001
From: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Date: Fri, 20 Mar 2015 17:41:43 +0000
Subject: net: validate the range we feed to iov_iter_init() in sys_sendto/sys_recvfrom
From: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
commit 4de930efc23b92ddf88ce91c405ee645fe6e27ea upstream.
Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/socket.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/socket.c
+++ b/net/socket.c
@@ -1765,6 +1765,8 @@ SYSCALL_DEFINE6(sendto, int, fd, void __
if (len > INT_MAX)
len = INT_MAX;
+ if (unlikely(!access_ok(VERIFY_READ, buff, len)))
+ return -EFAULT;
sock = sockfd_lookup_light(fd, &err, &fput_needed);
if (!sock)
goto out;
@@ -1823,6 +1825,8 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void
if (size > INT_MAX)
size = INT_MAX;
+ if (unlikely(!access_ok(VERIFY_WRITE, ubuf, size)))
+ return -EFAULT;
sock = sockfd_lookup_light(fd, &err, &fput_needed);
if (!sock)
goto out;
Patches currently in stable-queue which might be from viro@xxxxxxxxxxxxxxxxxx are
queue-3.19/net-validate-the-range-we-feed-to-iov_iter_init-in-sys_sendto-sys_recvfrom.patch
queue-3.19/caif-fix-msg_oob-test-in-caif_seqpkt_recvmsg.patch
queue-3.19/rxrpc-bogus-msg_peek-test-in-rxrpc_recvmsg.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html