Commit 7675e34e authored by Rémi Denis-Courmont's avatar Rémi Denis-Courmont Committed by Dong Chenchen
Browse files

phonet/pep: refuse to enable an unbound pipe

stable inclusion
from stable-v4.19.222
commit 982b6ba1ce626ef87e5c29f26f2401897554f235
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95RE9
CVE: CVE-2021-47086

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=982b6ba1ce626ef87e5c29f26f2401897554f235



--------------------------------

commit 75a2f315 upstream.

This ioctl() implicitly assumed that the socket was already bound to
a valid local socket name, i.e. Phonet object. If the socket was not
bound, two separate problems would occur:

1) We'd send an pipe enablement request with an invalid source object.
2) Later socket calls could BUG on the socket unexpectedly being
   connected yet not bound to a valid object.

Reported-by: default avatar <syzbot+2dc91e7fc3dea88b1e8a@syzkaller.appspotmail.com>
Signed-off-by: default avatarRémi Denis-Courmont <remi@remlab.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarDong Chenchen <dongchenchen2@huawei.com>
parent c0f28264
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment