Commit 91df43ce authored by Rémi Denis-Courmont's avatar Rémi Denis-Courmont Committed by Zheng Zengkai
Browse files

phonet/pep: refuse to enable an unbound pipe 

stable inclusion
from stable-v5.10.89
commit 52ad5da8e316fa11e3a50b3f089aa63e4089bf52
bugzilla: 186140 https://gitee.com/openeuler/kernel/issues/I4S8HA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=52ad5da8e316fa11e3a50b3f089aa63e4089bf52



--------------------------------

commit 75a2f315 upstream.

This ioctl() implicitly assumed that the socket was already bound to
a valid local socket name, i.e. Phonet object. If the socket was not
bound, two separate problems would occur:

1) We'd send an pipe enablement request with an invalid source object.
2) Later socket calls could BUG on the socket unexpectedly being
   connected yet not bound to a valid object.

Reported-by: default avatar <syzbot+2dc91e7fc3dea88b1e8a@syzkaller.appspotmail.com>
Signed-off-by: default avatarRémi Denis-Courmont <remi@remlab.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarChen Jun <chenjun102@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent a87d6afa

net/phonet/pep.c

+2 −0
Original line number Diff line number Diff line
@@ -947,6 +947,8 @@ static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg) 
			ret =  -EBUSY;

		else if (sk->sk_state == TCP_ESTABLISHED)

			ret = -EISCONN;

		else if (!pn->pn_sk.sobject)

			ret = -EADDRNOTAVAIL;

		else

			ret = pep_sock_enable(sk, NULL, 0);

		release_sock(sk);