Received: by 10.223.185.116 with SMTP id b49csp6431232wrg; Wed, 28 Feb 2018 09:16:48 -0800 (PST) X-Google-Smtp-Source: AH8x2268lkvfddikjcSvqJaokjt//8+LBltX3E6QmHDKsXXpBfudWe7zP72NuA8BWx3IUMDk9yY4 X-Received: by 10.98.35.195 with SMTP id q64mr18228118pfj.161.1519838208487; Wed, 28 Feb 2018 09:16:48 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519838208; cv=none; d=google.com; s=arc-20160816; b=UL/XkIb+ed9zQVpcTyajV7XL+Y4DB8cY7S2GSs/NKbjVJepIQxLhgwWUTshbrmAmr+ YxPxlMB5ZuGTNNFGrYtBEOpHkoTrHJVfkvO/jY1ribqzQSUQX6cgBHG6/MfTanJ13jJh kaWbl0xUegSeEWFGigzuw0lZqTwjRBVALt0VZfO0GhuwBceUjltqLq/kHu8ZV4C7xWV1 rOzDMVHgxmpXckxpY18KCA8ovWRd3IU+80IfYn4cVj2EPC+210CinCYLK9p/547nYs6y p6FkdsQ+CVYTg25XamWfijWhOm7ObPOYOXpTwA1fwWq2kUQLsc2VwbWlOr9Lm1dddzH1 zpHA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:in-reply-to:subject:message-id:date:cc:to :from:mime-version:content-transfer-encoding:content-disposition :arc-authentication-results; bh=aRfJWo9rNcPi4TZDF3SikHP05OiaZgfnWN8DXOvNb7Q=; b=M2t/GjOl4Dct/HsG5YRrcsIRLB8MFBcdp5BUS8/tMsCQIp/xXO4b8HVkw8evNLc1C2 5r0Pyl/DQsKihLkqZx/6Is4HajICrhjuEhUvM1OH+KDsH2SGZ4pQ8mAAu9yK+pZRn+ok Mr4iXnX+wTBn1y0J8whN+yQQR4kZdqv/m2rS2W9O7GeiFJFEim3Qp4B/bqAmIyNUvYQh ht5v2xqJhKZzyAmQSDXpclqEE9JOk8oPPVBSmc8Ox8TRlkWVgFYaPgoP/UNvByfi3d5M m2ulu/Ssxv7yobnVdKKnKrTlM+ObHqmsiXPkZdtZ4yggMlbg/ib2/CdvsbkyzfRzQMku kjng== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id k195si1242009pga.68.2018.02.28.09.16.31; Wed, 28 Feb 2018 09:16:48 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933661AbeB1ROR (ORCPT + 99 others); Wed, 28 Feb 2018 12:14:17 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:34272 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932916AbeB1Psl (ORCPT ); Wed, 28 Feb 2018 10:48:41 -0500 Received: from [2a02:8011:400e:2:6f00:88c8:c921:d332] (helo=deadeye) by shadbolt.decadent.org.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1er3Yp-0006Xe-FG; Wed, 28 Feb 2018 15:22:27 +0000 Received: from ben by deadeye with local (Exim 4.90_1) (envelope-from ) id 1er3Yk-0000Go-1c; Wed, 28 Feb 2018 15:22:22 +0000 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, syzbot+7b7b518b1228d2743963@syzkaller.appspotmail.com, "Marcelo Ricardo Leitner" , "David S. Miller" , "Neil Horman" , "Xin Long" Date: Wed, 28 Feb 2018 15:20:18 +0000 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.16 211/254] sctp: do not allow the v4 socket to bind a v4mapped v6 address In-Reply-To: X-SA-Exim-Connect-IP: 2a02:8011:400e:2:6f00:88c8:c921:d332 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.16.55-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Xin Long commit c5006b8aa74599ce19104b31d322d2ea9ff887cc upstream. The check in sctp_sockaddr_af is not robust enough to forbid binding a v4mapped v6 addr on a v4 socket. The worse thing is that v4 socket's bind_verify would not convert this v4mapped v6 addr to a v4 addr. syzbot even reported a crash as the v4 socket bound a v6 addr. This patch is to fix it by doing the common sa.sa_family check first, then AF_INET check for v4mapped v6 addrs. Fixes: 7dab83de50c7 ("sctp: Support ipv6only AF_INET6 sockets.") Reported-by: syzbot+7b7b518b1228d2743963@syzkaller.appspotmail.com Acked-by: Neil Horman Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller Signed-off-by: Ben Hutchings --- net/sctp/socket.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -303,16 +303,14 @@ static struct sctp_af *sctp_sockaddr_af( if (len < sizeof (struct sockaddr)) return NULL; + if (!opt->pf->af_supported(addr->sa.sa_family, opt)) + return NULL; + /* V4 mapped address are really of AF_INET family */ if (addr->sa.sa_family == AF_INET6 && - ipv6_addr_v4mapped(&addr->v6.sin6_addr)) { - if (!opt->pf->af_supported(AF_INET, opt)) - return NULL; - } else { - /* Does this PF support this AF? */ - if (!opt->pf->af_supported(addr->sa.sa_family, opt)) - return NULL; - } + ipv6_addr_v4mapped(&addr->v6.sin6_addr) && + !opt->pf->af_supported(AF_INET, opt)) + return NULL; /* If we get this far, af is valid. */ af = sctp_get_af_specific(addr->sa.sa_family);