]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
vhost: Check docket sk_family instead of call getname
authorEugenio Pérez <eperezma@redhat.com>
Fri, 21 Feb 2020 11:06:56 +0000 (12:06 +0100)
committerBen Hutchings <ben@decadent.org.uk>
Tue, 28 Apr 2020 18:03:43 +0000 (19:03 +0100)
commite4d98e5299b19e1caad03f0b38fd41b046d0de56
treecb556ad29d629407c59ba73179bf64109b3f0379
parent2f9ac30a54dc0181ddac3705cdcf4775d863c530
vhost: Check docket sk_family instead of call getname

commit 42d84c8490f9f0931786f1623191fcab397c3d64 upstream.

Doing so, we save one call to get data we already have in the struct.

Also, since there is no guarantee that getname use sockaddr_ll
parameter beyond its size, we add a little bit of security here.
It should do not do beyond MAX_ADDR_LEN, but syzbot found that
ax25_getname writes more (72 bytes, the size of full_sockaddr_ax25,
versus 20 + 32 bytes of sockaddr_ll + MAX_ADDR_LEN in syzbot repro).

Fixes: 3a4d5c94e9593 ("vhost_net: a kernel-level virtio server")
Reported-by: syzbot+f2a62d07a5198c819c7b@syzkaller.appspotmail.com
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: Also delete "uaddr_len" variable]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/vhost/net.c