Thread (3 messages) 3 messages, 3 authors, 2016-02-25

Re: [PATCH v2 net] nfc: close a race condition in llcp_sock_getname()

From: Cong Wang <hidden>
Date: 2016-02-24 18:54:37
Also in: linux-wireless

On Fri, Jan 29, 2016 at 11:37 AM, Cong Wang [off-list ref] wrote:
llcp_sock_getname() checks llcp_sock->dev to make sure
llcp_sock is already connected or bound, however, we could
be in the middle of llcp_sock_bind() where llcp_sock->dev
is bound and llcp_sock->service_name_len is set,
but llcp_sock->service_name is not, in this case we would
lead to copy some bytes from a NULL pointer.

Just lock the sock since this is not a hot path anyway.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Lauro Ramos Venancio <redacted>
Cc: Aloisio Almeida Jr <redacted>
Cc: Samuel Ortiz <redacted>
Signed-off-by: Cong Wang <redacted>

Samuel, please take a look at this one too.

quoted hunk ↗ jump to hunk
---
 net/nfc/llcp_sock.c | 6 ++++++
 1 file changed, 6 insertions(+)
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index ecf0a01..b9edf5f 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -509,6 +509,11 @@ static int llcp_sock_getname(struct socket *sock, struct sockaddr *uaddr,
        memset(llcp_addr, 0, sizeof(*llcp_addr));
        *len = sizeof(struct sockaddr_nfc_llcp);

+       lock_sock(sk);
+       if (!llcp_sock->dev) {
+               release_sock(sk);
+               return -EBADFD;
+       }
        llcp_addr->sa_family = AF_NFC;
        llcp_addr->dev_idx = llcp_sock->dev->idx;
        llcp_addr->target_idx = llcp_sock->target_idx;
@@ -518,6 +523,7 @@ static int llcp_sock_getname(struct socket *sock, struct sockaddr *uaddr,
        llcp_addr->service_name_len = llcp_sock->service_name_len;
        memcpy(llcp_addr->service_name, llcp_sock->service_name,
               llcp_addr->service_name_len);
+       release_sock(sk);

        return 0;
 }
--
1.8.3.1
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help