lkml.org 
[lkml]   [2018]   [Apr]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL for 4.4 033/162] caif: Add sockaddr length check before accessing sa_family in connect handler
    Date
    From: Mateusz Jurczyk <mjurczyk@google.com>

    [ Upstream commit 20a3d5bf5e5b13c02450ab6178ec374abd830686 ]

    Verify that the caller-provided sockaddr structure is large enough to
    contain the sa_family field, before accessing it in the connect()
    handler of the AF_CAIF socket. Since the syscall doesn't enforce a minimum
    size of the corresponding memory region, very short sockaddrs (zero or one
    byte long) result in operating on uninitialized memory while referencing
    sa_family.

    Signed-off-by: Mateusz Jurczyk <mjurczyk@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    ---
    net/caif/caif_socket.c | 4 ++++
    1 file changed, 4 insertions(+)

    diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
    index aa209b1066c9..bbc80e4e08f5 100644
    --- a/net/caif/caif_socket.c
    +++ b/net/caif/caif_socket.c
    @@ -754,6 +754,10 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,

    lock_sock(sk);

    + err = -EINVAL;
    + if (addr_len < offsetofend(struct sockaddr, sa_family))
    + goto out;
    +
    err = -EAFNOSUPPORT;
    if (uaddr->sa_family != AF_CAIF)
    goto out;
    --
    2.15.1
    \
     
     \ /
      Last update: 2018-04-09 03:34    [W:4.030 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site