Comment 3 for bug 1269053

I suspect that this recvmsg is triggering the error that is emitted:

    2775 recvmsg(9, 0x7fffbff554f0, 0) = -1 EINVAL (Invalid argument)

This might well indicate that this subprocess is using msg ipc to communicate the connected socket back to the unpriviledged master process. This could well occur if the bindsock process is passing an overly large message buffer, which is technically erroneous. This became fatal in the commit below in mainline:

  1661bf364ae9c506bc8795fef70d1532931be1e8
  Author: Dan Carpenter <email address hidden>
  Date: Thu Oct 3 00:27:20 2013 +0300

    net: heap overflow in __audit_sockaddr

This commit was applied to the various versions listed above as part of various stable updates.

There has subsequently been a fix for this commit which softens the effect for badly behaving callers:

  1661bf364ae9c506bc8795fef70d1532931be1e8
  Author: Dan Carpenter <email address hidden>
  Date: Thu Oct 3 00:27:20 2013 +0300

    net: heap overflow in __audit_sockaddr

This commit has recently hit v3.2.x stable but is not yet in any released kernel.