Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752490AbdFNOtV (ORCPT ); Wed, 14 Jun 2017 10:49:21 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:54612 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752267AbdFNOtU (ORCPT ); Wed, 14 Jun 2017 10:49:20 -0400 Subject: Re: [PATCH] af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers To: Mateusz Jurczyk , Ursula Braun , "David S. Miller" , linux-s390@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org References: <20170613174228.9218-1-mjurczyk@google.com> From: Julian Wiedmann Date: Wed, 14 Jun 2017 16:49:06 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.1.0 MIME-Version: 1.0 In-Reply-To: <20170613174228.9218-1-mjurczyk@google.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-TM-AS-GCONF: 00 x-cbid: 17061414-0008-0000-0000-000004673811 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17061414-0009-0000-0000-00001DF05885 Message-Id: X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-06-14_03:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1703280000 definitions=main-1706140250 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 581 Lines: 13 On 06/13/2017 07:42 PM, Mateusz Jurczyk wrote: > Verify that the caller-provided sockaddr structure is large enough to > contain the sa_family field, before accessing it in bind() and connect() > handlers of the AF_IUCV socket. Since neither syscall enforces a minimum > size of the corresponding memory region, very short sockaddrs (zero or > one byte long) result in operating on uninitialized memory while > referencing .sa_family. > > Signed-off-by: Mateusz Jurczyk Thanks Mateusz! Fixes: 52a82e23b9f2 Acked-by: Julian Wiedmann