From 442b20fa7004d9e7af953a55093645323a3f6cc9 Mon Sep 17 00:00:00 2001 From: Tetsuo Handa Date: Thu, 16 May 2019 18:14:59 +0000 Subject: [PATCH] bpf: Check address length before reading address family mainline inclusion from mainline-5.1-rc6 commit ba024f2574a1 category: bugfix bugzilla: 14086 CVE: NA ------------------------------------------------- KMSAN will complain if valid address length passed to bpf_bind() is shorter than sizeof("struct sockaddr"->sa_family) bytes. Signed-off-by: Tetsuo Handa Acked-by: Andrey Ignatov Signed-off-by: David S. Miller Signed-off-by: Zhiqiang Liu Reviewed-by: Wenan Mao Signed-off-by: Yang Yingliang --- net/core/filter.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/core/filter.c b/net/core/filter.c index 1d80f76de660..b2d17ae2d951 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -4149,6 +4149,8 @@ BPF_CALL_3(bpf_bind, struct bpf_sock_addr_kern *, ctx, struct sockaddr *, addr, * Only binding to IP is supported. */ err = -EINVAL; + if (addr_len < offsetofend(struct sockaddr, sa_family)) + return err; if (addr->sa_family == AF_INET) { if (addr_len < sizeof(struct sockaddr_in)) return err; -- GitLab