From: Mateusz Jurczyk Date: Thu, 8 Jun 2017 09:13:36 +0000 (+0200) Subject: af_unix: Add sockaddr length checks before accessing sa_family in bind and connect... X-Git-Tag: v4.12-rc6~32^2~36 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=defbcf2decc903a28d8398aa477b6881e711e3ea;p=thirdparty%2Flinux.git af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers Verify that the caller-provided sockaddr structure is large enough to contain the sa_family field, before accessing it in bind() and connect() handlers of the AF_UNIX socket. Since neither syscall enforces a minimum size of the corresponding memory region, very short sockaddrs (zero or one byte long) result in operating on uninitialized memory while referencing .sa_family. Signed-off-by: Mateusz Jurczyk Signed-off-by: David S. Miller --- diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index 6a7fe7660551f..1a0c961f4ffee 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -999,7 +999,8 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) struct path path = { }; err = -EINVAL; - if (sunaddr->sun_family != AF_UNIX) + if (addr_len < offsetofend(struct sockaddr_un, sun_family) || + sunaddr->sun_family != AF_UNIX) goto out; if (addr_len == sizeof(short)) { @@ -1110,6 +1111,10 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr, unsigned int hash; int err; + err = -EINVAL; + if (alen < offsetofend(struct sockaddr, sa_family)) + goto out; + if (addr->sa_family != AF_UNSPEC) { err = unix_mkname(sunaddr, alen, &hash); if (err < 0)