about summary refs log tree commit diff
path: root/sysdeps/unix/sysv/linux/check_native.c
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2015-11-09 12:48:41 +0100
committerFlorian Weimer <fweimer@redhat.com>2015-11-09 12:48:41 +0100
commit2eecc8afd02d8c65cf098cbae4de87f332dc21bd (patch)
treea36cb50020b3836a379e515af5d1874d8d8ea92f /sysdeps/unix/sysv/linux/check_native.c
parentf3d18efb8a720121066dc3401e822043beb98cde (diff)
downloadglibc-2eecc8afd02d8c65cf098cbae4de87f332dc21bd.tar.gz
glibc-2eecc8afd02d8c65cf098cbae4de87f332dc21bd.tar.xz
glibc-2eecc8afd02d8c65cf098cbae4de87f332dc21bd.zip
Terminate process on invalid netlink response from kernel [BZ #12926]
The recvmsg system calls for netlink sockets have been particularly
prone to picking up unrelated data after a file descriptor race
(where the descriptor is closed and reopened concurrently in a
multi-threaded process, as the result of a file descriptor
management issue elsewhere).  This commit adds additional error
checking and aborts the process if a datagram of unexpected length
(without the netlink header) is received, or an error code which
cannot happen due to the way the netlink socket is used.

	[BZ #12926]
	Terminate process on invalid netlink response.
	* sysdeps/unix/sysv/linux/netlinkaccess.h
	(__netlink_assert_response): Declare.
	* sysdeps/unix/sysv/linux/netlink_assert_response.c: New file.
	* sysdeps/unix/sysv/linux/Makefile [$(subdir) == inet]
	(sysdep_routines): Add netlink_assert_response.
	* sysdeps/unix/sysv/linux/check_native.c (__check_native): Call
	__netlink_assert_response.
	* sysdeps/unix/sysv/linux/check_pf.c (make_request): Likewise.
	* sysdeps/unix/sysv/linux/ifaddrs.c (__netlink_request): Likewise.
	* sysdeps/unix/sysv/linux/Versions (GLIBC_PRIVATE): Add
	__netlink_assert_response.
Diffstat (limited to 'sysdeps/unix/sysv/linux/check_native.c')
-rw-r--r--sysdeps/unix/sysv/linux/check_native.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/sysdeps/unix/sysv/linux/check_native.c b/sysdeps/unix/sysv/linux/check_native.c
index eaefca10e4..d04c8f2a1f 100644
--- a/sysdeps/unix/sysv/linux/check_native.c
+++ b/sysdeps/unix/sysv/linux/check_native.c
@@ -35,6 +35,7 @@
 
 #include <not-cancel.h>
 
+#include "netlinkaccess.h"
 
 void
 __check_native (uint32_t a1_index, int *a1_native,
@@ -117,6 +118,7 @@ __check_native (uint32_t a1_index, int *a1_native,
 	};
 
       ssize_t read_len = TEMP_FAILURE_RETRY (__recvmsg (fd, &msg, 0));
+      __netlink_assert_response (fd, read_len);
       if (read_len < 0)
 	goto out_fail;