Andrew Geissler | 595f630 | 2022-01-24 19:11:47 +0000 | [diff] [blame] | 1 | From e368b12f6c16b6888dda99ba641e999b9c9643c8 Mon Sep 17 00:00:00 2001 |
| 2 | From: Florian Weimer <fweimer@redhat.com> |
| 3 | Date: Mon, 17 Jan 2022 10:21:34 +0100 |
| 4 | Subject: [PATCH] socket: Add the __sockaddr_un_set function |
| 5 | |
| 6 | Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=e368b12f6c16b6888dda99ba641e999b9c9643c8] |
| 7 | CVE: CVE-2022-23219 |
| 8 | |
| 9 | Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> |
| 10 | Signed-off-by: Pgowda <pgowda.cve@gmail.com> |
| 11 | --- |
| 12 | include/sys/un.h | 12 +++++++ |
| 13 | socket/Makefile | 6 +++- |
| 14 | socket/sockaddr_un_set.c | 41 ++++++++++++++++++++++++ |
| 15 | socket/tst-sockaddr_un_set.c | 62 ++++++++++++++++++++++++++++++++++++ |
| 16 | 4 files changed, 120 insertions(+), 1 deletion(-) |
| 17 | create mode 100644 socket/sockaddr_un_set.c |
| 18 | create mode 100644 socket/tst-sockaddr_un_set.c |
| 19 | |
| 20 | diff --git a/include/sys/un.h b/include/sys/un.h |
| 21 | index bdbee99980..152afd9fc7 100644 |
| 22 | --- a/include/sys/un.h |
| 23 | +++ b/include/sys/un.h |
| 24 | @@ -1 +1,13 @@ |
| 25 | #include <socket/sys/un.h> |
| 26 | + |
| 27 | +#ifndef _ISOMAC |
| 28 | + |
| 29 | +/* Set ADDR->sun_family to AF_UNIX and ADDR->sun_path to PATHNAME. |
| 30 | + Return 0 on success or -1 on failure (due to overlong PATHNAME). |
| 31 | + The caller should always use sizeof (struct sockaddr_un) as the |
| 32 | + socket address length, disregaring the length of PATHNAME. |
| 33 | + Only concrete (non-abstract) pathnames are supported. */ |
| 34 | +int __sockaddr_un_set (struct sockaddr_un *addr, const char *pathname) |
| 35 | + attribute_hidden; |
| 36 | + |
| 37 | +#endif /* _ISOMAC */ |
| 38 | diff --git a/socket/Makefile b/socket/Makefile |
| 39 | index 39333e10ca..156eec6c85 100644 |
| 40 | --- a/socket/Makefile |
| 41 | +++ b/socket/Makefile |
| 42 | @@ -29,13 +29,17 @@ headers := sys/socket.h sys/un.h bits/sockaddr.h bits/socket.h \ |
| 43 | routines := accept bind connect getpeername getsockname getsockopt \ |
| 44 | listen recv recvfrom recvmsg send sendmsg sendto \ |
| 45 | setsockopt shutdown socket socketpair isfdtype opensock \ |
| 46 | - sockatmark accept4 recvmmsg sendmmsg |
| 47 | + sockatmark accept4 recvmmsg sendmmsg sockaddr_un_set |
| 48 | |
| 49 | tests := \ |
| 50 | tst-accept4 \ |
| 51 | tst-sockopt \ |
| 52 | # tests |
| 53 | |
| 54 | +tests-internal := \ |
| 55 | + tst-sockaddr_un_set \ |
| 56 | + # tests-internal |
| 57 | + |
| 58 | tests-time64 := \ |
| 59 | tst-sockopt-time64 \ |
| 60 | # tests |
| 61 | diff --git a/socket/sockaddr_un_set.c b/socket/sockaddr_un_set.c |
| 62 | new file mode 100644 |
| 63 | index 0000000000..0bd40dc34e |
| 64 | --- /dev/null |
| 65 | +++ b/socket/sockaddr_un_set.c |
| 66 | @@ -0,0 +1,41 @@ |
| 67 | +/* Set the sun_path member of struct sockaddr_un. |
| 68 | + Copyright (C) 2022 Free Software Foundation, Inc. |
| 69 | + This file is part of the GNU C Library. |
| 70 | + |
| 71 | + The GNU C Library is free software; you can redistribute it and/or |
| 72 | + modify it under the terms of the GNU Lesser General Public |
| 73 | + License as published by the Free Software Foundation; either |
| 74 | + version 2.1 of the License, or (at your option) any later version. |
| 75 | + |
| 76 | + The GNU C Library is distributed in the hope that it will be useful, |
| 77 | + but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 78 | + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| 79 | + Lesser General Public License for more details. |
| 80 | + |
| 81 | + You should have received a copy of the GNU Lesser General Public |
| 82 | + License along with the GNU C Library; if not, see |
| 83 | + <https://www.gnu.org/licenses/>. */ |
| 84 | + |
| 85 | +#include <errno.h> |
| 86 | +#include <string.h> |
| 87 | +#include <sys/socket.h> |
| 88 | +#include <sys/un.h> |
| 89 | + |
| 90 | +int |
| 91 | +__sockaddr_un_set (struct sockaddr_un *addr, const char *pathname) |
| 92 | +{ |
| 93 | + size_t name_length = strlen (pathname); |
| 94 | + |
| 95 | + /* The kernel supports names of exactly sizeof (addr->sun_path) |
| 96 | + bytes, without a null terminator, but userspace does not; see the |
| 97 | + SUN_LEN macro. */ |
| 98 | + if (name_length >= sizeof (addr->sun_path)) |
| 99 | + { |
| 100 | + __set_errno (EINVAL); /* Error code used by the kernel. */ |
| 101 | + return -1; |
| 102 | + } |
| 103 | + |
| 104 | + addr->sun_family = AF_UNIX; |
| 105 | + memcpy (addr->sun_path, pathname, name_length + 1); |
| 106 | + return 0; |
| 107 | +} |
| 108 | diff --git a/socket/tst-sockaddr_un_set.c b/socket/tst-sockaddr_un_set.c |
| 109 | new file mode 100644 |
| 110 | index 0000000000..29c2a81afd |
| 111 | --- /dev/null |
| 112 | +++ b/socket/tst-sockaddr_un_set.c |
| 113 | @@ -0,0 +1,62 @@ |
| 114 | +/* Test the __sockaddr_un_set function. |
| 115 | + Copyright (C) 2022 Free Software Foundation, Inc. |
| 116 | + This file is part of the GNU C Library. |
| 117 | + |
| 118 | + The GNU C Library is free software; you can redistribute it and/or |
| 119 | + modify it under the terms of the GNU Lesser General Public |
| 120 | + License as published by the Free Software Foundation; either |
| 121 | + version 2.1 of the License, or (at your option) any later version. |
| 122 | + |
| 123 | + The GNU C Library is distributed in the hope that it will be useful, |
| 124 | + but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 125 | + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| 126 | + Lesser General Public License for more details. |
| 127 | + |
| 128 | + You should have received a copy of the GNU Lesser General Public |
| 129 | + License along with the GNU C Library; if not, see |
| 130 | + <https://www.gnu.org/licenses/>. */ |
| 131 | + |
| 132 | +/* Re-compile the function because the version in libc is not |
| 133 | + exported. */ |
| 134 | +#include "sockaddr_un_set.c" |
| 135 | + |
| 136 | +#include <support/check.h> |
| 137 | + |
| 138 | +static int |
| 139 | +do_test (void) |
| 140 | +{ |
| 141 | + struct sockaddr_un sun; |
| 142 | + |
| 143 | + memset (&sun, 0xcc, sizeof (sun)); |
| 144 | + __sockaddr_un_set (&sun, ""); |
| 145 | + TEST_COMPARE (sun.sun_family, AF_UNIX); |
| 146 | + TEST_COMPARE (__sockaddr_un_set (&sun, ""), 0); |
| 147 | + |
| 148 | + memset (&sun, 0xcc, sizeof (sun)); |
| 149 | + TEST_COMPARE (__sockaddr_un_set (&sun, "/example"), 0); |
| 150 | + TEST_COMPARE_STRING (sun.sun_path, "/example"); |
| 151 | + |
| 152 | + { |
| 153 | + char pathname[108]; /* Length of sun_path (ABI constant). */ |
| 154 | + memset (pathname, 'x', sizeof (pathname)); |
| 155 | + pathname[sizeof (pathname) - 1] = '\0'; |
| 156 | + memset (&sun, 0xcc, sizeof (sun)); |
| 157 | + TEST_COMPARE (__sockaddr_un_set (&sun, pathname), 0); |
| 158 | + TEST_COMPARE (sun.sun_family, AF_UNIX); |
| 159 | + TEST_COMPARE_STRING (sun.sun_path, pathname); |
| 160 | + } |
| 161 | + |
| 162 | + { |
| 163 | + char pathname[109]; |
| 164 | + memset (pathname, 'x', sizeof (pathname)); |
| 165 | + pathname[sizeof (pathname) - 1] = '\0'; |
| 166 | + memset (&sun, 0xcc, sizeof (sun)); |
| 167 | + errno = 0; |
| 168 | + TEST_COMPARE (__sockaddr_un_set (&sun, pathname), -1); |
| 169 | + TEST_COMPARE (errno, EINVAL); |
| 170 | + } |
| 171 | + |
| 172 | + return 0; |
| 173 | +} |
| 174 | + |
| 175 | +#include <support/test-driver.c> |
| 176 | -- |
| 177 | 2.27.0 |
| 178 | |