Module Name: src
Committed By: maxv
Date: Sun Feb 24 07:20:33 UTC 2019
Modified Files:
src/sys/netatalk: ddp_usrreq.c
src/sys/netinet: raw_ip.c sctp_usrreq.c
src/sys/netinet6: raw_ip6.c sctp6_usrreq.c
Log Message:
RIP, RIP6, DDP, SCTP and SCTP6 lack a length check in their _connect()
functions. Fix the first three, and add a big XXX in the SCTP ones.
Found by KASAN, triggered by SyzKaller.
Reported-by: syzbot+9eaf98dad6ca738c2...@syzkaller.appspotmail.com
To generate a diff of this commit:
cvs rdiff -u -r1.72 -r1.73 src/sys/netatalk/ddp_usrreq.c
cvs rdiff -u -r1.178 -r1.179 src/sys/netinet/raw_ip.c
cvs rdiff -u -r1.16 -r1.17 src/sys/netinet/sctp_usrreq.c
cvs rdiff -u -r1.173 -r1.174 src/sys/netinet6/raw_ip6.c
cvs rdiff -u -r1.17 -r1.18 src/sys/netinet6/sctp6_usrreq.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/netatalk/ddp_usrreq.c
diff -u src/sys/netatalk/ddp_usrreq.c:1.72 src/sys/netatalk/ddp_usrreq.c:1.73
--- src/sys/netatalk/ddp_usrreq.c:1.72 Mon Jan 28 12:53:01 2019
+++ src/sys/netatalk/ddp_usrreq.c Sun Feb 24 07:20:33 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: ddp_usrreq.c,v 1.72 2019/01/28 12:53:01 martin Exp $ */
+/* $NetBSD: ddp_usrreq.c,v 1.73 2019/02/24 07:20:33 maxv Exp $ */
/*
* Copyright (c) 1990,1991 Regents of The University of Michigan.
@@ -27,7 +27,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ddp_usrreq.c,v 1.72 2019/01/28 12:53:01 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ddp_usrreq.c,v 1.73 2019/02/24 07:20:33 maxv Exp $");
#include "opt_mbuftrace.h"
#include "opt_atalk.h"
@@ -185,9 +185,11 @@ at_pcbconnect(struct ddpcb *ddp, struct
struct ifnet *ifp;
u_short hintnet = 0, net;
- if (sat->sat_family != AF_APPLETALK) {
+ if (sat->sat_family != AF_APPLETALK)
return EAFNOSUPPORT;
- }
+ if (sat->sat_len != sizeof(*sat))
+ return EINVAL;
+
/*
* Under phase 2, network 0 means "the network". We take "the
* network" to mean the network the control block is bound to.
Index: src/sys/netinet/raw_ip.c
diff -u src/sys/netinet/raw_ip.c:1.178 src/sys/netinet/raw_ip.c:1.179
--- src/sys/netinet/raw_ip.c:1.178 Fri Sep 14 05:09:51 2018
+++ src/sys/netinet/raw_ip.c Sun Feb 24 07:20:33 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: raw_ip.c,v 1.178 2018/09/14 05:09:51 maxv Exp $ */
+/* $NetBSD: raw_ip.c,v 1.179 2019/02/24 07:20:33 maxv Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -65,7 +65,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: raw_ip.c,v 1.178 2018/09/14 05:09:51 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: raw_ip.c,v 1.179 2019/02/24 07:20:33 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_inet.h"
@@ -499,6 +499,8 @@ rip_connect_pcb(struct inpcb *inp, struc
return (EADDRNOTAVAIL);
if (addr->sin_family != AF_INET)
return (EAFNOSUPPORT);
+ if (addr->sin_len != sizeof(*addr))
+ return EINVAL;
inp->inp_faddr = addr->sin_addr;
return (0);
}
Index: src/sys/netinet/sctp_usrreq.c
diff -u src/sys/netinet/sctp_usrreq.c:1.16 src/sys/netinet/sctp_usrreq.c:1.17
--- src/sys/netinet/sctp_usrreq.c:1.16 Fri Feb 15 14:13:32 2019
+++ src/sys/netinet/sctp_usrreq.c Sun Feb 24 07:20:33 2019
@@ -1,5 +1,5 @@
/* $KAME: sctp_usrreq.c,v 1.50 2005/06/16 20:45:29 jinmei Exp $ */
-/* $NetBSD: sctp_usrreq.c,v 1.16 2019/02/15 14:13:32 rjs Exp $ */
+/* $NetBSD: sctp_usrreq.c,v 1.17 2019/02/24 07:20:33 maxv Exp $ */
/*
* Copyright (c) 2001, 2002, 2003, 2004 Cisco Systems, Inc.
@@ -33,7 +33,7 @@
* SUCH DAMAGE.
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sctp_usrreq.c,v 1.16 2019/02/15 14:13:32 rjs Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sctp_usrreq.c,v 1.17 2019/02/24 07:20:33 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_inet.h"
@@ -3342,6 +3342,11 @@ sctp_connect(struct socket *so, struct s
return (EINVAL);
}
#endif /* INET6 */
+
+ /*
+ * XXX XXX XXX Check nam->sa_len?
+ */
+
if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) ==
SCTP_PCB_FLAGS_UNBOUND) {
/* Bind a ephemeral port */
Index: src/sys/netinet6/raw_ip6.c
diff -u src/sys/netinet6/raw_ip6.c:1.173 src/sys/netinet6/raw_ip6.c:1.174
--- src/sys/netinet6/raw_ip6.c:1.173 Mon Jan 28 12:53:01 2019
+++ src/sys/netinet6/raw_ip6.c Sun Feb 24 07:20:33 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: raw_ip6.c,v 1.173 2019/01/28 12:53:01 martin Exp $ */
+/* $NetBSD: raw_ip6.c,v 1.174 2019/02/24 07:20:33 maxv Exp $ */
/* $KAME: raw_ip6.c,v 1.82 2001/07/23 18:57:56 jinmei Exp $ */
/*
@@ -62,7 +62,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: raw_ip6.c,v 1.173 2019/01/28 12:53:01 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: raw_ip6.c,v 1.174 2019/02/24 07:20:33 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_ipsec.h"
@@ -716,6 +716,8 @@ rip6_connect(struct socket *so, struct s
return EADDRNOTAVAIL;
if (addr->sin6_family != AF_INET6)
return EAFNOSUPPORT;
+ if (addr->sin6_len != sizeof(*addr))
+ return EINVAL;
/*
* Application should provide a proper zone ID or the use of
Index: src/sys/netinet6/sctp6_usrreq.c
diff -u src/sys/netinet6/sctp6_usrreq.c:1.17 src/sys/netinet6/sctp6_usrreq.c:1.18
--- src/sys/netinet6/sctp6_usrreq.c:1.17 Mon Jan 28 12:53:01 2019
+++ src/sys/netinet6/sctp6_usrreq.c Sun Feb 24 07:20:33 2019
@@ -1,5 +1,5 @@
/* $KAME: sctp6_usrreq.c,v 1.38 2005/08/24 08:08:56 suz Exp $ */
-/* $NetBSD: sctp6_usrreq.c,v 1.17 2019/01/28 12:53:01 martin Exp $ */
+/* $NetBSD: sctp6_usrreq.c,v 1.18 2019/02/24 07:20:33 maxv Exp $ */
/*
* Copyright (c) 2001, 2002, 2003, 2004 Cisco Systems, Inc.
@@ -33,7 +33,7 @@
* SUCH DAMAGE.
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sctp6_usrreq.c,v 1.17 2019/01/28 12:53:01 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sctp6_usrreq.c,v 1.18 2019/02/24 07:20:33 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_inet.h"
@@ -961,6 +961,11 @@ sctp6_connect(struct socket *so, struct
#ifdef INET
sin6 = (struct sockaddr_in6 *)nam;
+
+ /*
+ * XXX XXX XXX Check sin6->sin6_len?
+ */
+
if (inp6->in6p_flags & IN6P_IPV6_V6ONLY) {
/*
* if IPV6_V6ONLY flag, ignore connections
