linux/net/rds
Tetsuo Handa dd3ac9a684 net/rds: Check address length before reading address family
syzbot is reporting uninitialized value at rds_connect() [1] and
rds_bind() [2]. This is because syzbot is passing ulen == 0 whereas
these functions expect that it is safe to access sockaddr->family field
in order to determine minimal address length for validation.

[1] https://syzkaller.appspot.com/bug?id=f4e61c010416c1e6f0fa3ffe247561b60a50ad71
[2] https://syzkaller.appspot.com/bug?id=a4bf9e41b7e055c3823fdcd83e8c58ca7270e38f

Reported-by: syzbot <syzbot+0049bebbf3042dbd2e8f@syzkaller.appspotmail.com>
Reported-by: syzbot <syzbot+915c9f99f3dbc4bd6cd1@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-04-12 10:25:03 -07:00
..
af_rds.c net/rds: Check address length before reading address family 2019-04-12 10:25:03 -07:00
bind.c net/rds: Check address length before reading address family 2019-04-12 10:25:03 -07:00
cong.c
connection.c rds: add type of service(tos) infrastructure 2019-02-04 14:59:12 -08:00
ib_cm.c rds: rdma: update rdma transport for tos 2019-02-04 14:59:13 -08:00
ib_fmr.c IB/core: Remove ib_sg_dma_address() and ib_sg_dma_len() 2019-02-04 14:34:07 -07:00
ib_frmr.c IB/core: Remove ib_sg_dma_address() and ib_sg_dma_len() 2019-02-04 14:34:07 -07:00
ib_mr.h Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net 2018-08-02 10:55:32 -07:00
ib_rdma.c Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net 2018-08-02 10:55:32 -07:00
ib_recv.c 5.1 Merge Window Pull Request 2019-03-09 15:53:03 -08:00
ib_ring.c
ib_send.c 5.1 Merge Window Pull Request 2019-03-09 15:53:03 -08:00
ib_stats.c
ib_sysctl.c
ib.c rds: add transport specific tos_map hook 2019-02-04 14:59:13 -08:00
ib.h 5.1 Merge Window Pull Request 2019-03-09 15:53:03 -08:00
info.c
info.h
Kconfig net/rds: RDS is not Radio Data System 2018-08-31 23:09:53 -07:00
loop.c
loop.h
Makefile
message.c rds: use DIV_ROUND_UP instead of ceil 2019-01-07 07:22:36 -08:00
page.c
rdma_transport.c rds: rdma: update rdma transport for tos 2019-02-04 14:59:13 -08:00
rdma_transport.h rds: rdma: add consumer reject 2019-02-04 14:59:11 -08:00
rdma.c net/rds: remove user triggered WARN_ON in rds_sendmsg 2018-12-19 10:27:58 -08:00
rds_single_path.h
rds.h rds: add transport specific tos_map hook 2019-02-04 14:59:13 -08:00
recv.c rds: add type of service(tos) infrastructure 2019-02-04 14:59:12 -08:00
send.c rds: rdma: update rdma transport for tos 2019-02-04 14:59:13 -08:00
stats.c
sysctl.c
tcp_connect.c
tcp_listen.c rds: add type of service(tos) infrastructure 2019-02-04 14:59:12 -08:00
tcp_recv.c
tcp_send.c
tcp_stats.c
tcp.c net: rds: force to destroy connection if t_sock is NULL in rds_tcp_kill_sock(). 2019-03-28 17:17:18 -07:00
tcp.h
threads.c rds: make v3.1 as compat version 2019-02-04 14:59:11 -08:00
transport.c