net/rds: Check address length before reading address family
authorTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fri, 12 Apr 2019 10:51:52 +0000 (19:51 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 2 May 2019 07:58:57 +0000 (09:58 +0200)
commit5a228d5ddca2423b6e47045b9aac7df4362146a1
tree4beb0b2b94d4baf739a1f5be8c0f98a81999e429
parente30203e4f94d2ba92a54fd3662bf1517a3fb7269
net/rds: Check address length before reading address family

commit dd3ac9a684358b8c1d5c432ca8322aaf5e4f28ee upstream.

syzbot is reporting uninitialized value at rds_connect() [1] and
rds_bind() [2]. This is because syzbot is passing ulen == 0 whereas
these functions expect that it is safe to access sockaddr->family field
in order to determine minimal address length for validation.

[1] https://syzkaller.appspot.com/bug?id=f4e61c010416c1e6f0fa3ffe247561b60a50ad71
[2] https://syzkaller.appspot.com/bug?id=a4bf9e41b7e055c3823fdcd83e8c58ca7270e38f

Reported-by: syzbot <syzbot+0049bebbf3042dbd2e8f@syzkaller.appspotmail.com>
Reported-by: syzbot <syzbot+915c9f99f3dbc4bd6cd1@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/rds/af_rds.c
net/rds/bind.c