lkml.org 
[lkml]   [2020]   [Nov]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.9 151/391] net: 9p: initialize sun_server.sun_path to have addrs value only when addr is valid
    Date
    From: Anant Thazhemadam <anant.thazhemadam@gmail.com>

    [ Upstream commit 7ca1db21ef8e0e6725b4d25deed1ca196f7efb28 ]

    In p9_fd_create_unix, checking is performed to see if the addr (passed
    as an argument) is NULL or not.
    However, no check is performed to see if addr is a valid address, i.e.,
    it doesn't entirely consist of only 0's.
    The initialization of sun_server.sun_path to be equal to this faulty
    addr value leads to an uninitialized variable, as detected by KMSAN.
    Checking for this (faulty addr) and returning a negative error number
    appropriately, resolves this issue.

    Link: http://lkml.kernel.org/r/20201012042404.2508-1-anant.thazhemadam@gmail.com
    Reported-by: syzbot+75d51fe5bf4ebe988518@syzkaller.appspotmail.com
    Tested-by: syzbot+75d51fe5bf4ebe988518@syzkaller.appspotmail.com
    Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
    Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/9p/trans_fd.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
    index c0762a302162c..8f528e783a6c5 100644
    --- a/net/9p/trans_fd.c
    +++ b/net/9p/trans_fd.c
    @@ -1023,7 +1023,7 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args)

    csocket = NULL;

    - if (addr == NULL)
    + if (!addr || !strlen(addr))
    return -EINVAL;

    if (strlen(addr) >= UNIX_PATH_MAX) {
    --
    2.27.0


    \
     
     \ /
      Last update: 2020-11-03 21:44    [W:4.049 / U:0.068 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site