Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756914AbdGCPLP (ORCPT ); Mon, 3 Jul 2017 11:11:15 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:34456 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755010AbdGCNhM (ORCPT ); Mon, 3 Jul 2017 09:37:12 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mateusz Jurczyk , "David S. Miller" Subject: [PATCH 4.4 005/101] af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers Date: Mon, 3 Jul 2017 15:34:05 +0200 Message-Id: <20170703133335.307379915@linuxfoundation.org> X-Mailer: git-send-email 2.13.2 In-Reply-To: <20170703133334.237346187@linuxfoundation.org> References: <20170703133334.237346187@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1479 Lines: 47 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mateusz Jurczyk [ Upstream commit defbcf2decc903a28d8398aa477b6881e711e3ea ] Verify that the caller-provided sockaddr structure is large enough to contain the sa_family field, before accessing it in bind() and connect() handlers of the AF_UNIX socket. Since neither syscall enforces a minimum size of the corresponding memory region, very short sockaddrs (zero or one byte long) result in operating on uninitialized memory while referencing .sa_family. Signed-off-by: Mateusz Jurczyk Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/unix/af_unix.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -997,7 +997,8 @@ static int unix_bind(struct socket *sock struct path path = { NULL, NULL }; err = -EINVAL; - if (sunaddr->sun_family != AF_UNIX) + if (addr_len < offsetofend(struct sockaddr_un, sun_family) || + sunaddr->sun_family != AF_UNIX) goto out; if (addr_len == sizeof(short)) { @@ -1108,6 +1109,10 @@ static int unix_dgram_connect(struct soc unsigned int hash; int err; + err = -EINVAL; + if (alen < offsetofend(struct sockaddr, sa_family)) + goto out; + if (addr->sa_family != AF_UNSPEC) { err = unix_mkname(sunaddr, alen, &hash); if (err < 0)