releases/2.6.36.2/econet-disallow-null-remote-addr-for-sendmsg-fixes-cve-2010-3849.patch

   1 From fa0e846494792e722d817b9d3d625a4ef4896c96 Mon Sep 17 00:00:00 2001
   2 From: Phil Blundell <philb@gnu.org>
   3 Date: Wed, 24 Nov 2010 11:49:19 -0800
   4 Subject: econet: disallow NULL remote addr for sendmsg(), fixes CVE-2010-3849
   5
   6 From: Phil Blundell <philb@gnu.org>
   7
   8 commit fa0e846494792e722d817b9d3d625a4ef4896c96 upstream.
   9
  10 Later parts of econet_sendmsg() rely on saddr != NULL, so return early
  11 with EINVAL if NULL was passed otherwise an oops may occur.
  12
  13 Signed-off-by: Phil Blundell <philb@gnu.org>
  14 Signed-off-by: David S. Miller <davem@davemloft.net>
  15 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  16
  17 ---
  18  net/econet/af_econet.c |   26 ++++++++------------------
  19  1 file changed, 8 insertions(+), 18 deletions(-)
  20
  21 --- a/net/econet/af_econet.c
  22 +++ b/net/econet/af_econet.c
  23 @@ -297,23 +297,14 @@ static int econet_sendmsg(struct kiocb *
  24
  25         mutex_lock(&econet_mutex);
  26
  27 -       if (saddr == NULL) {
  28 -               struct econet_sock *eo = ec_sk(sk);
  29 -
  30 -               addr.station = eo->station;
  31 -               addr.net     = eo->net;
  32 -               port         = eo->port;
  33 -               cb           = eo->cb;
  34 -       } else {
  35 -               if (msg->msg_namelen < sizeof(struct sockaddr_ec)) {
  36 -                       mutex_unlock(&econet_mutex);
  37 -                       return -EINVAL;
  38 -               }
  39 -               addr.station = saddr->addr.station;
  40 -               addr.net = saddr->addr.net;
  41 -               port = saddr->port;
  42 -               cb = saddr->cb;
  43 -       }
  44 +        if (saddr == NULL || msg->msg_namelen < sizeof(struct sockaddr_ec)) {
  45 +                mutex_unlock(&econet_mutex);
  46 +                return -EINVAL;
  47 +        }
  48 +        addr.station = saddr->addr.station;
  49 +        addr.net = saddr->addr.net;
  50 +        port = saddr->port;
  51 +        cb = saddr->cb;
  52
  53         /* Look for a device with the right network number. */
  54         dev = net2dev_map[addr.net];
  55 @@ -351,7 +342,6 @@ static int econet_sendmsg(struct kiocb *
  56
  57                 eb = (struct ec_cb *)&skb->cb;
  58
  59 -               /* BUG: saddr may be NULL */
  60                 eb->cookie = saddr->cookie;
  61                 eb->sec = *saddr;
  62                 eb->sent = ec_tx_done;