Re: Re: Linux kernel: more net info leak fixes for v3.9

[P J P <ppandit () redhat com>]

+-- On Mon, 22 Apr 2013, Mathias Krause wrote --+
| partly... Have a look at verify_iovec()/verify_compat_iovec(). They're
| updating the msg_name and msg_iov pointers.

  I did, both seem to use user supplied `msg_namelen' value to copy contents 
from user `msg_name' to `sockaddr_storage addr' variable. And when 
`msg_namelen' is zero(0) msg_name is set to NULL. Later same `msg_namelen' 
bytes are copied to user area, right?

Ah..right, both are called with `mode = VERIFY_WRITE' and both initialise 
`addr' variable when mode = VERIFY_READ.

If it's copying user data to `addr', why selectively do it when mode = 
VERIFY_READ?

Also, wouldn't - memset(addr, 0, sizeof(addr)) - fix this leak for all 
definitions of <proto>_recvmsg() routine??

Thank you.
--
Prasad J Pandit / Red Hat Security Response Team
DB7A 84C5 D3F9 7CD1 B5EB  C939 D048 7860 3655 602B