lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-07-28 00:21:52 +03:00
Code Activity

Terminate process on invalid netlink response from kernel [BZ #12926]

Browse Source 
The recvmsg system calls for netlink sockets have been particularly
prone to picking up unrelated data after a file descriptor race
(where the descriptor is closed and reopened concurrently in a
multi-threaded process, as the result of a file descriptor
management issue elsewhere).  This commit adds additional error
checking and aborts the process if a datagram of unexpected length
(without the netlink header) is received, or an error code which
cannot happen due to the way the netlink socket is used.

	[BZ #12926]
	Terminate process on invalid netlink response.
	* sysdeps/unix/sysv/linux/netlinkaccess.h
	(__netlink_assert_response): Declare.
	* sysdeps/unix/sysv/linux/netlink_assert_response.c: New file.
	* sysdeps/unix/sysv/linux/Makefile [$(subdir) == inet]
	(sysdep_routines): Add netlink_assert_response.
	* sysdeps/unix/sysv/linux/check_native.c (__check_native): Call
	__netlink_assert_response.
	* sysdeps/unix/sysv/linux/check_pf.c (make_request): Likewise.
	* sysdeps/unix/sysv/linux/ifaddrs.c (__netlink_request): Likewise.
	* sysdeps/unix/sysv/linux/Versions (GLIBC_PRIVATE): Add
	__netlink_assert_response.
This commit is contained in:
Florian Weimer
2015-11-09 12:48:41 +01:00
parent f3d18efb8a
commit 2eecc8afd0
9 changed files with 145 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
sysdeps/unix/sysv/linux/check_pf.c
View File

@ -36,6 +36,7 @@
#include <atomic.h>
#include <nscd/nscd-client.h>
#include "netlinkaccess.h"
#ifndef IFA_F_HOMEADDRESS
# define IFA_F_HOMEADDRESS 0
@ -164,7 +165,8 @@ make_request (int fd, pid_t pid)
};
ssize_t read_len = TEMP_FAILURE_RETRY (__recvmsg (fd, &msg, 0));
if (read_len <= 0)
__netlink_assert_response (fd, read_len);
if (read_len < 0)
goto out_fail;
if (msg.msg_flags & MSG_TRUNC)