]> git.ipfire.org Git - thirdparty/linux.git/commit
net/rds: Check address length before reading address family
authorTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fri, 12 Apr 2019 10:51:52 +0000 (19:51 +0900)
committerDavid S. Miller <davem@davemloft.net>
Fri, 12 Apr 2019 17:25:03 +0000 (10:25 -0700)
commitdd3ac9a684358b8c1d5c432ca8322aaf5e4f28ee
treed26646689cb2f5280c29e6d0545ee4be38375ab2
parente3058450965972e67cc0e5492c08c4cdadafc134
net/rds: Check address length before reading address family

syzbot is reporting uninitialized value at rds_connect() [1] and
rds_bind() [2]. This is because syzbot is passing ulen == 0 whereas
these functions expect that it is safe to access sockaddr->family field
in order to determine minimal address length for validation.

[1] https://syzkaller.appspot.com/bug?id=f4e61c010416c1e6f0fa3ffe247561b60a50ad71
[2] https://syzkaller.appspot.com/bug?id=a4bf9e41b7e055c3823fdcd83e8c58ca7270e38f

Reported-by: syzbot <syzbot+0049bebbf3042dbd2e8f@syzkaller.appspotmail.com>
Reported-by: syzbot <syzbot+915c9f99f3dbc4bd6cd1@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/rds/af_rds.c
net/rds/bind.c