We need to check that sock_from_file(req->file) != NULL. Reported-by: syzbot <syzbot+1e811482aa2c70afa9a0@xxxxxxxxxxxxxxxxxxxxxxxxx> Closes: https://syzkaller.appspot.com/bug?extid=1e811482aa2c70afa9a0 Fixes: 7481fd93fa0a ("io_uring: Introduce IORING_OP_BIND") Fixes: ff140cc8628a ("io_uring: Introduce IORING_OP_LISTEN") Signed-off-by: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx> --- io_uring/net.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/io_uring/net.c b/io_uring/net.c index 69af3df4dc48c..2cfe8bb6e17f2 100644 --- a/io_uring/net.c +++ b/io_uring/net.c @@ -1741,9 +1741,13 @@ int io_bind(struct io_kiocb *req, unsigned int issue_flags) { struct io_bind *bind = io_kiocb_to_cmd(req, struct io_bind); struct io_async_msghdr *io = req->async_data; + struct socket *sock = sock_from_file(req->file); int ret; - ret = __sys_bind_socket(sock_from_file(req->file), &io->addr, bind->addr_len); + if (unlikely(!sock)) + return -ENOTSOCK; + + ret = __sys_bind_socket(sock, &io->addr, bind->addr_len); if (ret < 0) req_set_fail(req); io_req_set_res(req, ret, 0); @@ -1764,9 +1768,13 @@ int io_listen_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) int io_listen(struct io_kiocb *req, unsigned int issue_flags) { struct io_listen *listen = io_kiocb_to_cmd(req, struct io_listen); + struct socket *sock = sock_from_file(req->file); int ret; - ret = __sys_listen_socket(sock_from_file(req->file), listen->backlog); + if (unlikely(!sock)) + return -ENOTSOCK; + + ret = __sys_listen_socket(sock, listen->backlog); if (ret < 0) req_set_fail(req); io_req_set_res(req, ret, 0); -- 2.43.5
