path: root/net/compat.c
diff options
authorDavid S. Miller <davem@davemloft.net>2010-10-28 11:41:55 -0700
committerDavid S. Miller <davem@davemloft.net>2010-10-28 11:47:52 -0700
commit8acfe468b0384e834a303f08ebc4953d72fb690a (patch)
tree7ecee335efdbd283a122bcba1d5d9b533906142a /net/compat.c
parent349f6c5c5d827db909a69e5b9e844e8623c8e881 (diff)
net: Limit socket I/O iovec total length to INT_MAX.
This helps protect us from overflow issues down in the individual protocol sendmsg/recvmsg handlers. Once we hit INT_MAX we truncate out the rest of the iovec by setting the iov_len members to zero. This works because: 1) For SOCK_STREAM and SOCK_SEQPACKET sockets, partial writes are allowed and the application will just continue with another write to send the rest of the data. 2) For datagram oriented sockets, where there must be a one-to-one correspondance between write() calls and packets on the wire, INT_MAX is going to be far larger than the packet size limit the protocol is going to check for and signal with -EMSGSIZE. Based upon a patch by Linus Torvalds. Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/compat.c')
1 files changed, 6 insertions, 4 deletions
diff --git a/net/compat.c b/net/compat.c
index 63d260e81472..3649d5895361 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -41,10 +41,12 @@ static inline int iov_from_user_compat_to_kern(struct iovec *kiov,
compat_size_t len;
if (get_user(len, &uiov32->iov_len) ||
- get_user(buf, &uiov32->iov_base)) {
- tot_len = -EFAULT;
- break;
- }
+ get_user(buf, &uiov32->iov_base))
+ return -EFAULT;
+ if (len > INT_MAX - tot_len)
+ len = INT_MAX - tot_len;
tot_len += len;
kiov->iov_base = compat_ptr(buf);
kiov->iov_len = (__kernel_size_t) len;

Privacy Policy