af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers
Verify that the caller-provided sockaddr structure is large enough to contain the sa_family field, before accessing it in bind() and connect() handlers of the AF_UNIX socket. Since neither syscall enforces a minimum size of the corresponding memory region, very short sockaddrs (zero or one byte long) result in operating on uninitialized memory while referencing .sa_family. Change-Id: Ifa18852cf4380eac682bd3a533abf6a512b5ec47 Signed-off-by: Mateusz Jurczyk <mjurczyk@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
This commit is contained in:
parent
47644ea6cf
commit
056e93f83e
|
@ -950,7 +950,8 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
|
|||
struct hlist_head *list;
|
||||
|
||||
err = -EINVAL;
|
||||
if (sunaddr->sun_family != AF_UNIX)
|
||||
if (addr_len < offsetofend(struct sockaddr_un, sun_family) ||
|
||||
sunaddr->sun_family != AF_UNIX)
|
||||
goto out;
|
||||
|
||||
if (addr_len == sizeof(short)) {
|
||||
|
@ -1090,6 +1091,10 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
|
|||
unsigned hash;
|
||||
int err;
|
||||
|
||||
err = -EINVAL;
|
||||
if (alen < offsetofend(struct sockaddr, sa_family))
|
||||
goto out;
|
||||
|
||||
if (addr->sa_family != AF_UNSPEC) {
|
||||
err = unix_mkname(sunaddr, alen, &hash);
|
||||
if (err < 0)
|
||||
|
|
Loading…
Reference in New Issue