* [PATCH] phonet/pep: refuse to enable an unbound pipe
@ 2021-12-19 17:03 remi
2021-12-20 12:00 ` patchwork-bot+netdevbpf
0 siblings, 1 reply; 2+ messages in thread
From: remi @ 2021-12-19 17:03 UTC (permalink / raw)
To: davem, kuba, netdev; +Cc: linux-kernel
From: Rémi Denis-Courmont <remi@remlab.net>
This ioctl() implicitly assumed that the socket was already bound to
a valid local socket name, i.e. Phonet object. If the socket was not
bound, two separate problems would occur:
1) We'd send an pipe enablement request with an invalid source object.
2) Later socket calls could BUG on the socket unexpectedly being
connected yet not bound to a valid object.
Reported-by: syzbot+2dc91e7fc3dea88b1e8a@syzkaller.appspotmail.com
Signed-off-by: Rémi Denis-Courmont <remi@remlab.net>
---
net/phonet/pep.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index b4f90afb0638..65d463ad8770 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -947,6 +947,8 @@ static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg)
ret = -EBUSY;
else if (sk->sk_state == TCP_ESTABLISHED)
ret = -EISCONN;
+ else if (!pn->pn_sk.sobject)
+ ret = -EADDRNOTAVAIL;
else
ret = pep_sock_enable(sk, NULL, 0);
release_sock(sk);
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] phonet/pep: refuse to enable an unbound pipe
2021-12-19 17:03 [PATCH] phonet/pep: refuse to enable an unbound pipe remi
@ 2021-12-20 12:00 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 2+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-12-20 12:00 UTC (permalink / raw)
To: =?utf-8?q?R=C3=A9mi_Denis-Courmont_=3Cremi=40remlab=2Enet=3E?=
Cc: davem, kuba, netdev, linux-kernel
Hello:
This patch was applied to netdev/net.git (master)
by David S. Miller <davem@davemloft.net>:
On Sun, 19 Dec 2021 19:03:39 +0200 you wrote:
> From: Rémi Denis-Courmont <remi@remlab.net>
>
> This ioctl() implicitly assumed that the socket was already bound to
> a valid local socket name, i.e. Phonet object. If the socket was not
> bound, two separate problems would occur:
>
> 1) We'd send an pipe enablement request with an invalid source object.
> 2) Later socket calls could BUG on the socket unexpectedly being
> connected yet not bound to a valid object.
>
> [...]
Here is the summary with links:
- phonet/pep: refuse to enable an unbound pipe
https://git.kernel.org/netdev/net/c/75a2f3152009
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-12-20 12:00 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-12-19 17:03 [PATCH] phonet/pep: refuse to enable an unbound pipe remi
2021-12-20 12:00 ` patchwork-bot+netdevbpf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.