Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753931AbdFMUPp (ORCPT ); Tue, 13 Jun 2017 16:15:45 -0400 Received: from shards.monkeyblade.net ([184.105.139.130]:49854 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752846AbdFMUPo (ORCPT ); Tue, 13 Jun 2017 16:15:44 -0400 Date: Tue, 13 Jun 2017 16:15:42 -0400 (EDT) Message-Id: <20170613.161542.837461878998748762.davem@davemloft.net> To: mjurczyk@google.com Cc: jwi@linux.vnet.ibm.com, ubraun@linux.vnet.ibm.com, linux-s390@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers From: David Miller In-Reply-To: <20170613174228.9218-1-mjurczyk@google.com> References: <20170613174228.9218-1-mjurczyk@google.com> X-Mailer: Mew version 6.7 on Emacs 24.5 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Tue, 13 Jun 2017 12:34:02 -0700 (PDT) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 854 Lines: 21 From: Mateusz Jurczyk Date: Tue, 13 Jun 2017 19:42:28 +0200 > Verify that the caller-provided sockaddr structure is large enough to > contain the sa_family field, before accessing it in bind() and connect() > handlers of the AF_IUCV socket. Since neither syscall enforces a minimum > size of the corresponding memory region, very short sockaddrs (zero or > one byte long) result in operating on uninitialized memory while > referencing .sa_family. > > Signed-off-by: Mateusz Jurczyk ... > /* Verify the input sockaddr */ > - if (!addr || addr->sa_family != AF_IUCV) > - return -EINVAL; > - > - if (addr_len < sizeof(struct sockaddr_iucv)) > + if (!addr || addr_len < sizeof(struct sockaddr_iucv) || > + addr->sa_family != AF_IUCV) The 'addr' can never be NULL so please remove that check, thank you.