| commit | dd3ac9a684358b8c1d5c432ca8322aaf5e4f28ee | [log] [tgz] |
|---|---|---|
| author | Tetsuo Handa <[email protected]> | Fri Apr 12 19:51:52 2019 +0900 |
| committer | David S. Miller <[email protected]> | Fri Apr 12 10:25:03 2019 -0700 |
| tree | d26646689cb2f5280c29e6d0545ee4be38375ab2 | |
| parent | e3058450965972e67cc0e5492c08c4cdadafc134 [diff] [blame] |
net/rds: Check address length before reading address family syzbot is reporting uninitialized value at rds_connect() [1] and rds_bind() [2]. This is because syzbot is passing ulen == 0 whereas these functions expect that it is safe to access sockaddr->family field in order to determine minimal address length for validation. [1] https://syzkaller.appspot.com/bug?id=f4e61c010416c1e6f0fa3ffe247561b60a50ad71 [2] https://syzkaller.appspot.com/bug?id=a4bf9e41b7e055c3823fdcd83e8c58ca7270e38f Reported-by: syzbot <[email protected]> Reported-by: syzbot <[email protected]> Signed-off-by: Tetsuo Handa <[email protected]> Acked-by: Santosh Shilimkar <[email protected]> Signed-off-by: David S. Miller <[email protected]>
diff --git a/net/rds/bind.c b/net/rds/bind.c index 17c9d9f..0f4398e 100644 --- a/net/rds/bind.c +++ b/net/rds/bind.c
@@ -173,6 +173,8 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) /* We allow an RDS socket to be bound to either IPv4 or IPv6 * address. */ + if (addr_len < offsetofend(struct sockaddr, sa_family)) + return -EINVAL; if (uaddr->sa_family == AF_INET) { struct sockaddr_in *sin = (struct sockaddr_in *)uaddr;