git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From foo@baz Thu Jun 29 19:38:17 CEST 2017
   2 From: Mateusz Jurczyk <mjurczyk@google.com>
   3 Date: Thu, 8 Jun 2017 11:13:36 +0200
   4 Subject: af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers
   5
   6 From: Mateusz Jurczyk <mjurczyk@google.com>
   7
   8
   9 [ Upstream commit defbcf2decc903a28d8398aa477b6881e711e3ea ]
  10
  11 Verify that the caller-provided sockaddr structure is large enough to
  12 contain the sa_family field, before accessing it in bind() and connect()
  13 handlers of the AF_UNIX socket. Since neither syscall enforces a minimum
  14 size of the corresponding memory region, very short sockaddrs (zero or
  15 one byte long) result in operating on uninitialized memory while
  16 referencing .sa_family.
  17
  18 Signed-off-by: Mateusz Jurczyk <mjurczyk@google.com>
  19 Signed-off-by: David S. Miller <davem@davemloft.net>
  20 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  21 ---
  22  net/unix/af_unix.c |    7 ++++++-
  23  1 file changed, 6 insertions(+), 1 deletion(-)
  24
  25 --- a/net/unix/af_unix.c
  26 +++ b/net/unix/af_unix.c
  27 @@ -997,7 +997,8 @@ static int unix_bind(struct socket *sock
  28         struct path path = { NULL, NULL };
  29
  30         err = -EINVAL;
  31 -       if (sunaddr->sun_family != AF_UNIX)
  32 +       if (addr_len < offsetofend(struct sockaddr_un, sun_family) ||
  33 +           sunaddr->sun_family != AF_UNIX)
  34                 goto out;
  35
  36         if (addr_len == sizeof(short)) {
  37 @@ -1108,6 +1109,10 @@ static int unix_dgram_connect(struct soc
  38         unsigned int hash;
  39         int err;
  40
  41 +       err = -EINVAL;
  42 +       if (alen < offsetofend(struct sockaddr, sa_family))
  43 +               goto out;
  44 +
  45         if (addr->sa_family != AF_UNSPEC) {
  46                 err = unix_mkname(sunaddr, alen, &hash);
  47                 if (err < 0)