• David Howells's avatar
    rxrpc: Fix network address validation · 66f6fd27
    David Howells authored
    Fix network address validation on entry to uapi functions such as connect()
    for AF_RXRPC.  The check for address compatibility with the transport
    socket isn't correct and allows an AF_INET6 address to be given to an
    AF_INET socket, resulting in an oops now that rxrpc is calling
    udp_sendmsg() directly.
    
    Sample program:
    
    	#define _GNU_SOURCE
    	#include <stdio.h>
    	#include <stdlib.h>
    	#include <sys/socket.h>
    	#include <arpa/inet.h>
    	#include <linux/rxrpc.h>
    	static unsigned char ctrl[256] =
    		"\x18\x00\x00\x00\x00\x00\x00\x00\x10\x01\x00\x00\x01";
    	int main(void)
    	{
    		struct sockaddr_rxrpc srx = {
    			.srx_family			= AF_RXRPC,
    			.transport_type			= SOCK_DGRAM,
    			.transport_len			= 28,
    			.transport.sin6.sin6_family	= AF_INET6,
    		};
    		struct mmsghdr vec = {
    			.msg_hdr.msg_control	= ctrl,
    			.msg_hdr.msg_controllen	= 0x18,
    		};
    		int s;
    		s = socket(AF_RXRPC, SOCK_DGRAM, AF_INET);
    		if (s < 0) {
    			perror("socket");
    			exit(1);
    		}
    		if (connect(s, (struct sockaddr *)&srx, sizeof(srx)) < 0) {
    			perror("connect");
    			exit(1);
    		}
    		if (sendmmsg(s, &vec, 1, MSG_NOSIGNAL | MSG_MORE) < 0) {
    			perror("sendmmsg");
    			exit(1);
    		}
    		return 0;
    	}
    
    If working properly, connect() should fail with EAFNOSUPPORT.
    
    Fixes: ed472b0c ("rxrpc: Call udp_sendmsg() directly")
    Reported-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
    cc: Marc Dionne <marc.dionne@auristor.com>
    cc: linux-afs@lists.infradead.org
    66f6fd27
af_rxrpc.c 25.2 KB