[PATCH] Fix getsockopt(SO_PEERNAME) buffer size against potential future buffer overflow

From: Samuel Thibault
Date: Sun Sep 28 2014 - 10:05:54 EST

In net/core/sock.c's sock_getsockopt, the address buffer size is
hardcoded to 128. It happens that sizeof(struct sockaddr_storage) is
indeed 128, but that is just luck and would probably not get updated
whenever sockaddr_storage would grow. This patch makes it simply use
sockaddr_storage instead.

Signed-off-by: Samuel Thibault <samuel.thibault@xxxxxxxxxxxx>

--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1155,13 +1155,13 @@ int sock_getsockopt(struct socket *sock,

- char address[128];
+ struct sockaddr_storage address;

- if (sock->ops->getname(sock, (struct sockaddr *)address, &lv, 2))
+ if (sock->ops->getname(sock, (struct sockaddr *)&address, &lv, 2))
return -ENOTCONN;
if (lv < len)
return -EINVAL;
- if (copy_to_user(optval, address, len))
+ if (copy_to_user(optval, &address, len))
return -EFAULT;
goto lenout;
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/