linux-toradex.git/net/tipc/socket.c, branch v3.2.47

tipc: fix info leaks via msg_name in recv_msg/recv_stream

2013-05-13T14:02:41+00:00

[ Upstream commit 60085c3d009b0df252547adb336d1ccca5ce52ec ]

The code in set_orig_addr() does not initialize all of the members of
struct sockaddr_tipc when filling the sockaddr info -- namely the union
is only partly filled. This will make recv_msg() and recv_stream() --
the only users of this function -- leak kernel stack memory as the
msg_name member is a local variable in net/socket.c.

Additionally to that both recv_msg() and recv_stream() fail to update
the msg_namelen member to 0 while otherwise returning with 0, i.e.
"success". This is the case for, e.g., non-blocking sockets. This will
lead to a 128 byte kernel stack leak in net/socket.c.

Fix the first issue by initializing the memory of the union with
memset(0). Fix the second one by setting msg_namelen to 0 early as it
will be updated later if we're going to fill the msg_name member.

Cc: Jon Maloy 
Cc: Allan Stephens 
Signed-off-by: Mathias Krause 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules

2011-10-31T23:30:30+00:00

These files are non modular, but need to export symbols using
the macros now living in export.h -- call out the include so
that things won't break when we remove the implicit presence
of module.h from everywhere.

Signed-off-by: Paul Gortmaker

tipc: Simplify prohibition of listen and accept for connectionless sockets

2011-09-18T02:55:12+00:00

Modifies the proto_ops structure used by TIPC DGRAM and RDM sockets
so that calls to listen() and accept() are handled by existing kernel
"unsupported operation" routines, and eliminates the related checks
in the listen and accept routines used by SEQPACKET and STREAM sockets
that are no longer needed.

Signed-off-by: Ying Xue 
Signed-off-by: Allan Stephens 
Signed-off-by: Paul Gortmaker

tipc: Add support for SO_SNDTIMEO socket option

2011-09-18T02:55:11+00:00

Adds support for the SO_SNDTIMEO socket option. (This complements the
existing support for SO_RCVTIMEO that is already present.)

Signed-off-by: Ying Xue 
Signed-off-by: Allan Stephens 
Signed-off-by: Paul Gortmaker

tipc: Prevent rounding issues when saving connect timeout option

2011-09-01T15:16:37+00:00

Saves a socket's TIPC_CONN_TIMEOUT socket option value in its original
form (milliseconds), rather than jiffies. This ensures that the exact
value set using setsockopt() is always returned by getsockopt(), without
being subject to rounding issues introduced by a ms->jiffies->ms
conversion sequence.

Signed-off-by: Allan Stephens 
Signed-off-by: Paul Gortmaker

tipc: Remove unnecessary includes in socket code

2011-06-24T20:18:16+00:00

Eliminates a pair of #include statements for files that are brought in
automatically by including core.h.

Signed-off-by: Allan Stephens 
Signed-off-by: Paul Gortmaker

tipc: Avoid recomputation of outgoing message length

2011-05-10T20:03:57+00:00

Rework TIPC's message sending routines to take advantage of the total
amount of data value passed to it by the kernel socket infrastructure.
This change eliminates the need for TIPC to compute the size of outgoing
messages itself, as well as the check for an oversize message in
tipc_msg_build().  In addition, this change warrants an explanation:

   -     res = send_packet(NULL, sock, &my_msg, 0);
   +     res = send_packet(NULL, sock, &my_msg, bytes_to_send);

Previously, the final argument to send_packet() was ignored (since the
amount of data being sent was recalculated by a lower-level routine)
and we could just pass in a dummy value (0). Now that the
recalculation is being eliminated, the argument value being passed to
send_packet() is significant and we have to supply the actual amount
of data we want to send.

Signed-off-by: Allan Stephens 
Signed-off-by: Paul Gortmaker

tipc: Abort excessive send requests as early as possible

2011-05-10T20:03:56+00:00

Adds checks to TIPC's socket send routines to promptly detect and
abort attempts to send more than 66,000 bytes in a single TIPC
message or more than 2**31-1 bytes in a single TIPC byte stream request.
In addition, this ensures that the number of iovecs in a send request
does not exceed the limits of a standard integer variable.

Signed-off-by: Allan Stephens 
Signed-off-by: Paul Gortmaker

tipc: Add support for SO_RCVTIMEO socket option

2011-03-13T20:35:16+00:00

Adds support for the SO_RCVTIMEO socket option to TIPC's socket
receive routines.

Thanks go out to Raj Hegde  for his contribution
to the development and testing this enhancement.

Signed-off-by: Allan Stephens 
Signed-off-by: Paul Gortmaker

tipc: Allow receiving into iovec containing multiple entries

2011-03-13T20:35:16+00:00

Enhances TIPC's socket receive routines to support iovec structures
containing more than a single entry. This change leverages existing
sk_buff routines to do most of the work; the only significant change
to TIPC itself is that an sk_buff now records how much data has been
already consumed as an numeric offset, rather than as a pointer to
the first unread data byte.

Signed-off-by: Allan Stephens 
Signed-off-by: Paul Gortmaker