From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753537AbbCWTam (ORCPT ); Mon, 23 Mar 2015 15:30:42 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:48579 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752619AbbCWTae (ORCPT ); Mon, 23 Mar 2015 15:30:34 -0400 From: Sasha Levin To: linux-kernel@vger.kernel.org Cc: erik.hugne@ericsson.com, ying.xue@windriver.com, jon.maloy@ericsson.com, davem@davemloft.net, Sasha Levin , Allan Stephens , netdev@vger.kernel.org (open list:TIPC NETWORK LAYER), tipc-discussion@lists.sourceforge.net (open list:TIPC NETWORK LAYER) Subject: [PATCH] tipc: validate length of sockaddr in connect() for dgram/rdm Date: Mon, 23 Mar 2015 15:30:00 -0400 Message-Id: <1427139003-30510-1-git-send-email-sasha.levin@oracle.com> X-Mailer: git-send-email 2.1.0 X-Source-IP: userv0021.oracle.com [156.151.31.71] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit f2f8036 ("tipc: add support for connect() on dgram/rdm sockets") hasn't validated user input length for the sockaddr structure which allows a user to overwrite kernel memory with arbitrary input. Fixes: f2f8036 ("tipc: add support for connect() on dgram/rdm sockets") Signed-off-by: Sasha Levin --- net/tipc/socket.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/tipc/socket.c b/net/tipc/socket.c index 73c2f51..986dc96 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -1852,6 +1852,8 @@ static int tipc_connect(struct socket *sock, struct sockaddr *dest, if (dst->family == AF_UNSPEC) { memset(&tsk->remote, 0, sizeof(struct sockaddr_tipc)); tsk->connected = 0; + } else if (destlen != sizeof(struct sockaddr_tipc)) { + res = -EINVAL; } else { memcpy(&tsk->remote, dest, destlen); tsk->connected = 1; -- 1.7.10.4