linux-kernel - [PATCH] io_uring: Check socket is valid in io_bind()/io

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <903da529-eaa3-43ef-ae41-d30f376c60cc@I-love.SAKURA.ne.jp>
Date: Sat, 13 Jul 2024 19:05:02 +0900
From: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To: syzbot <syzbot+1e811482aa2c70afa9a0@...kaller.appspotmail.com>,
        io-uring@...r.kernel.org, syzkaller-bugs@...glegroups.com,
        Pavel Begunkov <asml.silence@...il.com>,
        Gabriel Krisman Bertazi <krisman@...e.de>,
        Jens Axboe <axboe@...nel.dk>
Cc: linux-kernel@...r.kernel.org
Subject: [PATCH] io_uring: Check socket is valid in io_bind()/io_listen()

We need to check that sock_from_file(req->file) != NULL.

Reported-by: syzbot <syzbot+1e811482aa2c70afa9a0@...kaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=1e811482aa2c70afa9a0
Fixes: 7481fd93fa0a ("io_uring: Introduce IORING_OP_BIND")
Fixes: ff140cc8628a ("io_uring: Introduce IORING_OP_LISTEN")
Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
---
 io_uring/net.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/io_uring/net.c b/io_uring/net.c
index 69af3df4dc48c..2cfe8bb6e17f2 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -1741,9 +1741,13 @@ int io_bind(struct io_kiocb *req, unsigned int issue_flags)
 {
 	struct io_bind *bind = io_kiocb_to_cmd(req, struct io_bind);
 	struct io_async_msghdr *io = req->async_data;
+	struct socket *sock = sock_from_file(req->file);
 	int ret;
 
-	ret = __sys_bind_socket(sock_from_file(req->file),  &io->addr, bind->addr_len);
+	if (unlikely(!sock))
+		return -ENOTSOCK;
+
+	ret = __sys_bind_socket(sock, &io->addr, bind->addr_len);
 	if (ret < 0)
 		req_set_fail(req);
 	io_req_set_res(req, ret, 0);
@@ -1764,9 +1768,13 @@ int io_listen_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 int io_listen(struct io_kiocb *req, unsigned int issue_flags)
 {
 	struct io_listen *listen = io_kiocb_to_cmd(req, struct io_listen);
+	struct socket *sock = sock_from_file(req->file);
 	int ret;
 
-	ret = __sys_listen_socket(sock_from_file(req->file), listen->backlog);
+	if (unlikely(!sock))
+		return -ENOTSOCK;
+
+	ret = __sys_listen_socket(sock, listen->backlog);
 	if (ret < 0)
 		req_set_fail(req);
 	io_req_set_res(req, ret, 0);
-- 
2.43.5