vhost: Check docket sk_family instead of call getname
commit42d84c8490
upstream. Doing so, we save one call to get data we already have in the struct. Also, since there is no guarantee that getname use sockaddr_ll parameter beyond its size, we add a little bit of security here. It should do not do beyond MAX_ADDR_LEN, but syzbot found that ax25_getname writes more (72 bytes, the size of full_sockaddr_ax25, versus 20 + 32 bytes of sockaddr_ll + MAX_ADDR_LEN in syzbot repro). Fixes:3a4d5c94e9
("vhost_net: a kernel-level virtio server") Reported-by: syzbot+f2a62d07a5198c819c7b@syzkaller.appspotmail.com Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
68c601f2a2
commit
f09fbb1175
|
@ -1414,10 +1414,6 @@ static int vhost_net_release(struct inode *inode, struct file *f)
|
|||
|
||||
static struct socket *get_raw_socket(int fd)
|
||||
{
|
||||
struct {
|
||||
struct sockaddr_ll sa;
|
||||
char buf[MAX_ADDR_LEN];
|
||||
} uaddr;
|
||||
int r;
|
||||
struct socket *sock = sockfd_lookup(fd, &r);
|
||||
|
||||
|
@ -1430,11 +1426,7 @@ static struct socket *get_raw_socket(int fd)
|
|||
goto err;
|
||||
}
|
||||
|
||||
r = sock->ops->getname(sock, (struct sockaddr *)&uaddr.sa, 0);
|
||||
if (r < 0)
|
||||
goto err;
|
||||
|
||||
if (uaddr.sa.sll_family != AF_PACKET) {
|
||||
if (sock->sk->sk_family != AF_PACKET) {
|
||||
r = -EPFNOSUPPORT;
|
||||
goto err;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue