2020-04-18 15:34:13

by John Haxby

[permalink] [raw]
Subject: [PATCH 0/1] ipv6: fix restrict IPV6_ADDRFORM operation

Commit b6f6118901d1 ("ipv6: restrict IPV6_ADDRFORM operation") added a
check to ensure that sk->sk_prot is the default pointer for a TCP IPv6
socket, an issue found by syzbot.

The earlier code simply had

if (sk->sk_protocol != IPPROTO_TCP)
break;

and the new code degenerated to

if (sk->sk_protocol == IPPROTO_TCP)
break;

the very opposite of what was intended. The following patch
rearranges the checks so that the original sk->sk_prot == &tcpv6_prot
is just one of the series of checks made before moving the socket.

jch

John Haxby (1):
ipv6: fix restrict IPV6_ADDRFORM operation

net/ipv6/ipv6_sockglue.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)

--
2.25.3