phonet/pep: refuse to enable an unbound pipe
stable inclusion from stable-v5.10.89 commit 52ad5da8e316fa11e3a50b3f089aa63e4089bf52 bugzilla: 186140 https://gitee.com/openeuler/kernel/issues/I4S8HA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=52ad5da8e316fa11e3a50b3f089aa63e4089bf52 -------------------------------- commit 75a2f315 upstream. This ioctl() implicitly assumed that the socket was already bound to a valid local socket name, i.e. Phonet object. If the socket was not bound, two separate problems would occur: 1) We'd send an pipe enablement request with an invalid source object. 2) Later socket calls could BUG on the socket unexpectedly being connected yet not bound to a valid object. Reported-by:<syzbot+2dc91e7fc3dea88b1e8a@syzkaller.appspotmail.com> Signed-off-by:
Rémi Denis-Courmont <remi@remlab.net> Signed-off-by:
David S. Miller <davem@davemloft.net> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by:
Chen Jun <chenjun102@huawei.com> Signed-off-by:
Zheng Zengkai <zhengzengkai@huawei.com>
Loading
Please sign in to comment