iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mctp: handle the struct sockaddr_mctp_ext padding field

Browse Source 
struct sockaddr_mctp_ext.__smctp_paddin0 has to be checked for being set
to zero, otherwise it cannot be utilised in the future.

Fixes: 99ce45d5e7dbde39 ("mctp: Implement extended addressing")
Signed-off-by: Eugene Syromiatnikov <esyr@redhat.com>
Acked-by: Jeremy Kerr <jk@codeconstruct.com.au>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Eugene Syromiatnikov 2021-11-03 20:09:46 +01:00 committed by Jakub Kicinski
parent 1e4b50f06d
commit e9ea574ec1
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
net/mctp/af_mctp.c
View File

@ -39,6 +39,13 @@ static bool mctp_sockaddr_is_ok(const struct sockaddr_mctp *addr)
return !addr->__smctp_pad0 && !addr->__smctp_pad1; return !addr->__smctp_pad0 && !addr->__smctp_pad1;
} }
static bool mctp_sockaddr_ext_is_ok(const struct sockaddr_mctp_ext *addr)
{
return !addr->__smctp_pad0[0] &&
!addr->__smctp_pad0[1] &&
!addr->__smctp_pad0[2];
}
static int mctp_bind(struct socket *sock, struct sockaddr *addr, int addrlen) static int mctp_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
{ {
struct sock *sk = sock->sk; struct sock *sk = sock->sk;
@ -135,7 +142,8 @@ static int mctp_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
DECLARE_SOCKADDR(struct sockaddr_mctp_ext *, DECLARE_SOCKADDR(struct sockaddr_mctp_ext *,
extaddr, msg->msg_name); extaddr, msg->msg_name);
if (extaddr->smctp_halen > sizeof(cb->haddr)) { if (!mctp_sockaddr_ext_is_ok(extaddr) ||
extaddr->smctp_halen > sizeof(cb->haddr)) {
rc = -EINVAL; rc = -EINVAL;
goto err_free; goto err_free;
} }
@ -224,6 +232,7 @@ static int mctp_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
msg->msg_namelen = sizeof(*ae); msg->msg_namelen = sizeof(*ae);
ae->smctp_ifindex = cb->ifindex; ae->smctp_ifindex = cb->ifindex;
ae->smctp_halen = cb->halen; ae->smctp_halen = cb->halen;
memset(ae->__smctp_pad0, 0x0, sizeof(ae->__smctp_pad0));
memset(ae->smctp_haddr, 0x0, sizeof(ae->smctp_haddr)); memset(ae->smctp_haddr, 0x0, sizeof(ae->smctp_haddr));
memcpy(ae->smctp_haddr, cb->haddr, cb->halen); memcpy(ae->smctp_haddr, cb->haddr, cb->halen);
} }