Dapper SRU, CVE-2010-3859

[Tim Gardner]

The following changes since commit 935dc7c143df82eed4efe22af6f5d54a9e63e42d:
  Dan Rosenberg (1):
        drivers/video/sis/sis_main.c: prevent reading uninitialized stack memory, CVE-2010-4078

are available in the git repository at:

  git://kernel.ubuntu.com/rtg/ubuntu-dapper.git CVE-2010-3859

David S. Miller (1):
      net: Limit socket I/O iovec total length to INT_MAX., CVE-2010-3859

Tim Gardner (1):
      net: Truncate recvfrom and sendto length to INT_MAX., CVE-2010-3859

 net/compat.c     |    4 ++++
 net/core/iovec.c |   15 +++++++--------
 net/socket.c     |    6 ++++++
 3 files changed, 17 insertions(+), 8 deletions(-)

>From 56dbc8e48a729838dc4e625bdc00f594d06690cd Mon Sep 17 00:00:00 2001
From: Tim Gardner <tim.gardner at canonical.com>
Date: Thu, 27 Jan 2011 13:57:38 -0700
Subject: [PATCH 1/2] net: Truncate recvfrom and sendto length to INT_MAX., CVE-2010-3859

BugLink: http://bugs/launchpad.net/bugs/708839

CVE-2010-3859

Backported from commit 253eacc070b114c2ec1f81b067d2fed7305467b0 upstream.
Stable backported to 2.6.32.26

Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
Signed-off-by: David S. Miller <davem at davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
Signed-off-by: Tim Gardner <tim.gardner at canonical.com>
---
 net/socket.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/net/socket.c b/net/socket.c
index 6e57b95..8de4725 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1522,6 +1522,9 @@ SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
 	struct msghdr msg;
 	struct iovec iov;
 	
+	if (len > INT_MAX)
+		len = INT_MAX;
+
 	sock = sockfd_lookup(fd, &err);
 	if (!sock)
 		goto out;
@@ -1578,6 +1581,9 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
 	char address[MAX_SOCK_ADDR];
 	int err,err2;
 
+	if (size > INT_MAX)
+		size = INT_MAX;
+
 	sock = sockfd_lookup(fd, &err);
 	if (!sock)
 		goto out;
-- 
1.7.0.4


>From 1de1401d67094e23a678ce51de876d2e4d6ceaf8 Mon Sep 17 00:00:00 2001
From: David S. Miller <davem at davemloft.net>
Date: Thu, 28 Oct 2010 11:41:55 -0700
Subject: [PATCH 2/2] net: Limit socket I/O iovec total length to INT_MAX., CVE-2010-3859

BugLink: http://bugs.launchpad.net/bugs/708839

CVE-2010-3859

Backported from commit 8acfe468b0384e834a303f08ebc4953d72fb690a upstream.
Stable backported to 2.6.32.26

This helps protect us from overflow issues down in the
individual protocol sendmsg/recvmsg handlers.  Once
we hit INT_MAX we truncate out the rest of the iovec
by setting the iov_len members to zero.

This works because:

1) For SOCK_STREAM and SOCK_SEQPACKET sockets, partial
   writes are allowed and the application will just continue
   with another write to send the rest of the data.

2) For datagram oriented sockets, where there must be a
   one-to-one correspondance between write() calls and
   packets on the wire, INT_MAX is going to be far larger
   than the packet size limit the protocol is going to
   check for and signal with -EMSGSIZE.

Based upon a patch by Linus Torvalds.

Signed-off-by: David S. Miller <davem at davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
Signed-off-by: Tim Gardner <tim.gardner at canonical.com>
---
 net/compat.c     |    4 ++++
 net/core/iovec.c |   15 +++++++--------
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/net/compat.c b/net/compat.c
index e593dac..5eea482 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -44,6 +44,10 @@ static inline int iov_from_user_compat_to_kern(struct iovec *kiov,
 			tot_len = -EFAULT;
 			break;
 		}
+
+		if (len > INT_MAX - tot_len)
+			len = INT_MAX - tot_len;
+
 		tot_len += len;
 		kiov->iov_base = compat_ptr(buf);
 		kiov->iov_len = (__kernel_size_t) len;
diff --git a/net/core/iovec.c b/net/core/iovec.c
index 65e4b56..d647b3e 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -61,14 +61,13 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, char *address, int mode)
 	err = 0;
 
 	for (ct = 0; ct < m->msg_iovlen; ct++) {
-		err += iov[ct].iov_len;
-		/*
-		 * Goal is not to verify user data, but to prevent returning
-		 * negative value, which is interpreted as errno.
-		 * Overflow is still possible, but it is harmless.
-		 */
-		if (err < 0)
-			return -EMSGSIZE;
+		size_t len = iov[ct].iov_len;
+
+		if (len > INT_MAX - err) {
+			len = INT_MAX - err;
+			iov[ct].iov_len = len;
+		}
+		err += len;
 	}
 
 	return err;
-- 
1.7.0.4