2021-12-19 17:11:32

by Rémi Denis-Courmont

Subject: [PATCH] phonet/pep: refuse to enable an unbound pipe

From: Rémi Denis-Courmont <[email protected]>

This ioctl() implicitly assumed that the socket was already bound to
a valid local socket name, i.e. Phonet object. If the socket was not
bound, two separate problems would occur:

1) We'd send an pipe enablement request with an invalid source object.
2) Later socket calls could BUG on the socket unexpectedly being
connected yet not bound to a valid object.

Reported-by: [email protected]
Signed-off-by: Rémi Denis-Courmont <[email protected]>
---
net/phonet/pep.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index b4f90afb0638..65d463ad8770 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -947,6 +947,8 @@ static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg)
ret = -EBUSY;
else if (sk->sk_state == TCP_ESTABLISHED)
ret = -EISCONN;
+ else if (!pn->pn_sk.sobject)
+ ret = -EADDRNOTAVAIL;
else
ret = pep_sock_enable(sk, NULL, 0);
release_sock(sk);
--
2.34.1

2021-12-20 12:00:15

by patchwork-bot+netdevbpf

Subject: Re: [PATCH] phonet/pep: refuse to enable an unbound pipe

Hello:

This patch was applied to netdev/net.git (master)
by David S. Miller <[email protected]>:

On Sun, 19 Dec 2021 19:03:39 +0200 you wrote:
> From: Rémi Denis-Courmont <[email protected]>
>
> This ioctl() implicitly assumed that the socket was already bound to
> a valid local socket name, i.e. Phonet object. If the socket was not
> bound, two separate problems would occur:
>
> 1) We'd send an pipe enablement request with an invalid source object.
> 2) Later socket calls could BUG on the socket unexpectedly being
> connected yet not bound to a valid object.
>
> [...]

Here is the summary with links:
- phonet/pep: refuse to enable an unbound pipe
https://git.kernel.org/netdev/net/c/75a2f3152009

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html