diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2021-05-03 16:51:04 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2021-05-03 17:35:19 +0000 |
| commit | f161d294b92732df6254a89f393ab24999e122bf (patch) | |
| tree | 3b0c4e481060d66ae8cdad006c1569e3ca4a5520 /sys/dev/hyperv | |
| parent | a3c7da3d08eec921f16a32c4c716b896385264e9 (diff) | |
| download | src-f161d294b92732df6254a89f393ab24999e122bf.tar.gz src-f161d294b92732df6254a89f393ab24999e122bf.zip | |
Add missing sockaddr length and family validation to various protocols
Several protocol methods take a sockaddr as input. In some cases the
sockaddr lengths were not being validated, or were validated after some
out-of-bounds accesses could occur. Add requisite checking to various
protocol entry points, and convert some existing checks to assertions
where appropriate.
Reported by: syzkaller+KASAN
Reviewed by: tuexen, melifaro
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D29519
Diffstat (limited to 'sys/dev/hyperv')
| -rw-r--r-- | sys/dev/hyperv/hvsock/hv_sock.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/sys/dev/hyperv/hvsock/hv_sock.c b/sys/dev/hyperv/hvsock/hv_sock.c index d212c2d8c2de..bcc237271465 100644 --- a/sys/dev/hyperv/hvsock/hv_sock.c +++ b/sys/dev/hyperv/hvsock/hv_sock.c @@ -300,6 +300,7 @@ hvs_addr_set(struct sockaddr_hvs *addr, unsigned int port) { memset(addr, 0, sizeof(*addr)); addr->sa_family = AF_HYPERV; + addr->sa_len = sizeof(*addr); addr->hvs_port = port; } @@ -430,6 +431,12 @@ hvs_trans_bind(struct socket *so, struct sockaddr *addr, struct thread *td) __func__, sa->sa_family); return (EAFNOSUPPORT); } + if (sa->sa_len != sizeof(*sa)) { + HVSOCK_DBG(HVSOCK_DBG_ERR, + "%s: Not supported, sa_len is %u\n", + __func__, sa->sa_len); + return (EINVAL); + } HVSOCK_DBG(HVSOCK_DBG_VERBOSE, "%s: binding port = 0x%x\n", __func__, sa->hvs_port); @@ -521,6 +528,8 @@ hvs_trans_connect(struct socket *so, struct sockaddr *nam, struct thread *td) return (EINVAL); if (raddr->sa_family != AF_HYPERV) return (EAFNOSUPPORT); + if (raddr->sa_len != sizeof(*raddr)) + return (EINVAL); mtx_lock(&hvs_trans_socks_mtx); if (so->so_state & |