diff options
| author | Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> | 2024-07-13 13:05:02 +0300 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2024-07-13 15:40:15 +0300 |
| commit | ad00e629145b2b9f0d78aa46e204a9df7d628978 (patch) | |
| tree | ad98f39fc977024e6dc5c504bc44f189baed7861 | |
| parent | 943ad0b62e3c21f324c4884caa6cb4a871bca05c (diff) | |
| download | linux-ad00e629145b2b9f0d78aa46e204a9df7d628978.tar.xz | |
io_uring/net: check socket is valid in io_bind()/io_listen()
We need to check that sock_from_file(req->file) != NULL.
Reported-by: syzbot <syzbot+1e811482aa2c70afa9a0@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=1e811482aa2c70afa9a0
Fixes: 7481fd93fa0a ("io_uring: Introduce IORING_OP_BIND")
Fixes: ff140cc8628a ("io_uring: Introduce IORING_OP_LISTEN")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Link: https://lore.kernel.org/r/903da529-eaa3-43ef-ae41-d30f376c60cc@I-love.SAKURA.ne.jp
[axboe: move assignment of sock to where the NULL check is]
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | io_uring/net.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/io_uring/net.c b/io_uring/net.c index 25223e11958f..7ebbeab05fea 100644 --- a/io_uring/net.c +++ b/io_uring/net.c @@ -1747,9 +1747,14 @@ int io_bind(struct io_kiocb *req, unsigned int issue_flags) { struct io_bind *bind = io_kiocb_to_cmd(req, struct io_bind); struct io_async_msghdr *io = req->async_data; + struct socket *sock; int ret; - ret = __sys_bind_socket(sock_from_file(req->file), &io->addr, bind->addr_len); + sock = sock_from_file(req->file); + if (unlikely(!sock)) + return -ENOTSOCK; + + ret = __sys_bind_socket(sock, &io->addr, bind->addr_len); if (ret < 0) req_set_fail(req); io_req_set_res(req, ret, 0); @@ -1770,9 +1775,14 @@ int io_listen_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) int io_listen(struct io_kiocb *req, unsigned int issue_flags) { struct io_listen *listen = io_kiocb_to_cmd(req, struct io_listen); + struct socket *sock; int ret; - ret = __sys_listen_socket(sock_from_file(req->file), listen->backlog); + sock = sock_from_file(req->file); + if (unlikely(!sock)) + return -ENOTSOCK; + + ret = __sys_listen_socket(sock, listen->backlog); if (ret < 0) req_set_fail(req); io_req_set_res(req, ret, 0); |