]> git.baikalelectronics.ru Git - kernel.git/commit
net/rds: Check address length before reading address family
authorTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fri, 12 Apr 2019 10:51:52 +0000 (19:51 +0900)
committerDavid S. Miller <davem@davemloft.net>
Fri, 12 Apr 2019 17:25:03 +0000 (10:25 -0700)
commitf434ba4d988a39406f10b651d00f53c9cbbec1ba
treed26646689cb2f5280c29e6d0545ee4be38375ab2
parent49cd556fac587d830a5590c8c446ef9914a48904
net/rds: Check address length before reading address family

syzbot is reporting uninitialized value at rds_connect() [1] and
rds_bind() [2]. This is because syzbot is passing ulen == 0 whereas
these functions expect that it is safe to access sockaddr->family field
in order to determine minimal address length for validation.

[1] https://syzkaller.appspot.com/bug?id=f4e61c010416c1e6f0fa3ffe247561b60a50ad71
[2] https://syzkaller.appspot.com/bug?id=a4bf9e41b7e055c3823fdcd83e8c58ca7270e38f

Reported-by: syzbot <syzbot+0049bebbf3042dbd2e8f@syzkaller.appspotmail.com>
Reported-by: syzbot <syzbot+915c9f99f3dbc4bd6cd1@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/rds/af_rds.c
net/rds/bind.c