lkml.org 
[lkml]   [2018]   [Jan]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.18 47/52] sctp: do not allow the v4 socket to bind a v4mapped v6 address
    Date
    3.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Xin Long <lucien.xin@gmail.com>


    [ Upstream commit c5006b8aa74599ce19104b31d322d2ea9ff887cc ]

    The check in sctp_sockaddr_af is not robust enough to forbid binding a
    v4mapped v6 addr on a v4 socket.

    The worse thing is that v4 socket's bind_verify would not convert this
    v4mapped v6 addr to a v4 addr. syzbot even reported a crash as the v4
    socket bound a v6 addr.

    This patch is to fix it by doing the common sa.sa_family check first,
    then AF_INET check for v4mapped v6 addrs.

    Fixes: 7dab83de50c7 ("sctp: Support ipv6only AF_INET6 sockets.")
    Reported-by: syzbot+7b7b518b1228d2743963@syzkaller.appspotmail.com
    Acked-by: Neil Horman <nhorman@tuxdriver.com>
    Signed-off-by: Xin Long <lucien.xin@gmail.com>
    Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/sctp/socket.c | 14 ++++++--------
    1 file changed, 6 insertions(+), 8 deletions(-)

    --- a/net/sctp/socket.c
    +++ b/net/sctp/socket.c
    @@ -333,16 +333,14 @@ static struct sctp_af *sctp_sockaddr_af(
    if (len < sizeof (struct sockaddr))
    return NULL;

    + if (!opt->pf->af_supported(addr->sa.sa_family, opt))
    + return NULL;
    +
    /* V4 mapped address are really of AF_INET family */
    if (addr->sa.sa_family == AF_INET6 &&
    - ipv6_addr_v4mapped(&addr->v6.sin6_addr)) {
    - if (!opt->pf->af_supported(AF_INET, opt))
    - return NULL;
    - } else {
    - /* Does this PF support this AF? */
    - if (!opt->pf->af_supported(addr->sa.sa_family, opt))
    - return NULL;
    - }
    + ipv6_addr_v4mapped(&addr->v6.sin6_addr) &&
    + !opt->pf->af_supported(AF_INET, opt))
    + return NULL;

    /* If we get this far, af is valid. */
    af = sctp_get_af_specific(addr->sa.sa_family);

    \
     
     \ /
      Last update: 2018-01-29 22:01    [W:14.455 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site