From: Tetsuo Handa <[email protected]>
To: syzbot <[email protected]>,
[email protected], [email protected],
Pavel Begunkov <[email protected]>,
Gabriel Krisman Bertazi <[email protected]>,
Jens Axboe <[email protected]>
Cc: [email protected]
Subject: [PATCH] io_uring: Check socket is valid in io_bind()/io_listen()
Date: Sat, 13 Jul 2024 19:05:02 +0900 [thread overview]
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>
We need to check that sock_from_file(req->file) != NULL.
Reported-by: syzbot <[email protected]>
Closes: https://syzkaller.appspot.com/bug?extid=1e811482aa2c70afa9a0
Fixes: 7481fd93fa0a ("io_uring: Introduce IORING_OP_BIND")
Fixes: ff140cc8628a ("io_uring: Introduce IORING_OP_LISTEN")
Signed-off-by: Tetsuo Handa <[email protected]>
---
io_uring/net.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/io_uring/net.c b/io_uring/net.c
index 69af3df4dc48c..2cfe8bb6e17f2 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -1741,9 +1741,13 @@ int io_bind(struct io_kiocb *req, unsigned int issue_flags)
{
struct io_bind *bind = io_kiocb_to_cmd(req, struct io_bind);
struct io_async_msghdr *io = req->async_data;
+ struct socket *sock = sock_from_file(req->file);
int ret;
- ret = __sys_bind_socket(sock_from_file(req->file), &io->addr, bind->addr_len);
+ if (unlikely(!sock))
+ return -ENOTSOCK;
+
+ ret = __sys_bind_socket(sock, &io->addr, bind->addr_len);
if (ret < 0)
req_set_fail(req);
io_req_set_res(req, ret, 0);
@@ -1764,9 +1768,13 @@ int io_listen_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
int io_listen(struct io_kiocb *req, unsigned int issue_flags)
{
struct io_listen *listen = io_kiocb_to_cmd(req, struct io_listen);
+ struct socket *sock = sock_from_file(req->file);
int ret;
- ret = __sys_listen_socket(sock_from_file(req->file), listen->backlog);
+ if (unlikely(!sock))
+ return -ENOTSOCK;
+
+ ret = __sys_listen_socket(sock, listen->backlog);
if (ret < 0)
req_set_fail(req);
io_req_set_res(req, ret, 0);
--
2.43.5
next prev parent reply other threads:[~2024-07-13 10:05 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-07-13 8:21 [syzbot] [io-uring] general protection fault in tomoyo_socket_bind_permission syzbot
2024-07-13 10:05 ` Tetsuo Handa [this message]
2024-07-13 12:38 ` [PATCH] io_uring: Check socket is valid in io_bind()/io_listen() Jens Axboe
2024-07-13 12:40 ` Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=903da529-eaa3-43ef-ae41-d30f376c60cc@I-love.SAKURA.ne.jp \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox