Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19;
From:   Yann Droneaud <ydroneaud@opteya.com>
To:     "David S . Miller" <davem@davemloft.net>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>
Cc:     netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
        Yann Droneaud <ydroneaud@opteya.com>
Subject: [PATCH] af_unix: Escape abstract unix socket address
Date:   Wed,  6 Apr 2022 12:22:13 +0200
Message-Id: <20220406102213.2020784-1-ydroneaud@opteya.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

Abstract unix socket address are bytes sequences up to
108 bytes (UNIX_PATH_MAX == sizeof(struct sockaddr_un) -
offsetof(struct sockaddr_un, sun_path)).

As with any random string of bytes, printing them in
/proc/net/unix should be done with caution to prevent
misbehavior.

It would have been great to use seq_escape_mem() to escape
the control characters in a reversible way.

Unfortunately userspace might expect that NUL bytes are
replaced with '@' characters as it's done currently.

So this patch implements the following scheme: any control
characters, including NUL, in the abstract unix socket
addresses is replaced by '@' characters.

Sadly, with such non reversible escape scheme, abstract
addresses such as "\0\0", "\0\a", "\0\b", "\0\t", etc.
will have the same representation: "@@".

But will prevent "cat /proc/net/unix" from messing with
terminal, and will prevent "\n" in abstract address from
messing with parsing the list of Unix sockets.

Signed-off-by: Yann Droneaud <ydroneaud@opteya.com>
---
 net/unix/af_unix.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index e71a312faa1e..8021efd92301 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -3340,7 +3340,8 @@ static int unix_seq_show(struct seq_file *seq, void *v)
 				i++;
 			}
 			for ( ; i < len; i++)
-				seq_putc(seq, u->addr->name->sun_path[i] ?:
+				seq_putc(seq, !iscntrl(u->addr->name->sun_path[i]) ?
+					 u->addr->name->sun_path[i] :
 					 '@');
 		}
 		unix_state_unlock(s);
-- 
2.32.0