All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] phonet/pep: refuse to enable an unbound pipe
@ 2021-12-19 17:03 remi
  2021-12-20 12:00 ` patchwork-bot+netdevbpf
  0 siblings, 1 reply; 2+ messages in thread
From: remi @ 2021-12-19 17:03 UTC (permalink / raw)
  To: davem, kuba, netdev; +Cc: linux-kernel

From: Rémi Denis-Courmont <remi@remlab.net>

This ioctl() implicitly assumed that the socket was already bound to
a valid local socket name, i.e. Phonet object. If the socket was not
bound, two separate problems would occur:

1) We'd send an pipe enablement request with an invalid source object.
2) Later socket calls could BUG on the socket unexpectedly being
   connected yet not bound to a valid object.

Reported-by: syzbot+2dc91e7fc3dea88b1e8a@syzkaller.appspotmail.com
Signed-off-by: Rémi Denis-Courmont <remi@remlab.net>
---
 net/phonet/pep.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index b4f90afb0638..65d463ad8770 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -947,6 +947,8 @@ static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg)
 			ret =  -EBUSY;
 		else if (sk->sk_state == TCP_ESTABLISHED)
 			ret = -EISCONN;
+		else if (!pn->pn_sk.sobject)
+			ret = -EADDRNOTAVAIL;
 		else
 			ret = pep_sock_enable(sk, NULL, 0);
 		release_sock(sk);
-- 
2.34.1


^ permalink raw reply related	[flat|nested] 2+ messages in thread

* Re: [PATCH] phonet/pep: refuse to enable an unbound pipe
  2021-12-19 17:03 [PATCH] phonet/pep: refuse to enable an unbound pipe remi
@ 2021-12-20 12:00 ` patchwork-bot+netdevbpf
  0 siblings, 0 replies; 2+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-12-20 12:00 UTC (permalink / raw)
  To: =?utf-8?q?R=C3=A9mi_Denis-Courmont_=3Cremi=40remlab=2Enet=3E?=
  Cc: davem, kuba, netdev, linux-kernel

Hello:

This patch was applied to netdev/net.git (master)
by David S. Miller <davem@davemloft.net>:

On Sun, 19 Dec 2021 19:03:39 +0200 you wrote:
> From: Rémi Denis-Courmont <remi@remlab.net>
> 
> This ioctl() implicitly assumed that the socket was already bound to
> a valid local socket name, i.e. Phonet object. If the socket was not
> bound, two separate problems would occur:
> 
> 1) We'd send an pipe enablement request with an invalid source object.
> 2) Later socket calls could BUG on the socket unexpectedly being
>    connected yet not bound to a valid object.
> 
> [...]

Here is the summary with links:
  - phonet/pep: refuse to enable an unbound pipe
    https://git.kernel.org/netdev/net/c/75a2f3152009

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2021-12-20 12:00 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-12-19 17:03 [PATCH] phonet/pep: refuse to enable an unbound pipe remi
2021-12-20 12:00 ` patchwork-bot+netdevbpf

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.