Re: [PATCH] linux 2.9.10-rc1: Fix oops in unix_dgram_sendmsg when using SELinux and SOCK_SEQPACKET

[Ross Kendall Axe <ross.axe@blueyonder.co.uk>]

[-- Attachment #1.1: Type: text/plain, Size: 643 bytes --]

Ross Kendall Axe wrote:
> 
> 
> A possibility that hadn't occurred to me was using sendto to send packets
> without connecting. Is this supposed to work? If so, then my patch is
> indeed inappropriate. If not, then that needs fixing also.
> 
> Ross
> 

Well, my reading of socket(2) suggests that it's _not_ supposed to work.

This patch causes sendmsg on SOCK_SEQPACKET unix domain sockets to return
EISCONN or ENOTSUPP as appropriate if the 'to' address is specified. It
also causes recvmsg to return EINVAL on unconnected sockets. This
behaviour is consistent with SOCK_STREAM sockets.

signed-off-by: Ross Axe <ross.axe@blueyonder.co.uk>


[-- Attachment #1.2: unix-SOCK_SEQPACKET-unconnected-fix-2.6.10-rc2.patch --]
[-- Type: text/x-patch, Size: 747 bytes --]

--- linux-2.6.10-rc2/net/unix/af_unix.c.orig	2004-11-17 22:26:38.000000000 +0000
+++ linux-2.6.10-rc2/net/unix/af_unix.c	2004-11-17 23:13:37.000000000 +0000
@@ -1272,6 +1272,11 @@ static int unix_dgram_sendmsg(struct kio
 		goto out;
 
 	if (msg->msg_namelen) {
+		if (sk->sk_type == SOCK_SEQPACKET) {
+			err = sk->sk_state == TCP_ESTABLISHED
+				? -EISCONN : -EOPNOTSUPP;
+			goto out;
+		}
 		err = unix_mkname(sunaddr, msg->msg_namelen, &hash);
 		if (err < 0)
 			goto out;
@@ -1531,6 +1536,11 @@ static int unix_dgram_recvmsg(struct kio
 	struct sk_buff *skb;
 	int err;
 
+	err = -EINVAL;
+	if (sk->sk_type == SOCK_SEQPACKET && 
+	    sk->sk_state != TCP_ESTABLISHED)
+		goto out;
+
 	err = -EOPNOTSUPP;
 	if (flags&MSG_OOB)
 		goto out;


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 256 bytes --]