This is a note to let you know that I've just added the patch titled
af_unix: Cut unix_validate_addr() out of unix_mkname().
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
af_unix-cut-unix_validate_addr-out-of-unix_mkname.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit 66094a2eae821c3437f6bee8337b83adbd0663a4
Author: Kuniyuki Iwashima <kuniyu@xxxxxxxxxxxx>
Date: Wed Nov 24 11:14:23 2021 +0900
af_unix: Cut unix_validate_addr() out of unix_mkname().
[ Upstream commit b8a58aa6fccc5b2940f0da18c7f02e8a1deb693a ]
unix_mkname() tests socket address length and family and does some
processing based on the address type. It is called in the early stage,
and therefore some instructions are redundant and can end up in vain.
The address length/family tests are done twice in unix_bind(). Also, the
address type is rechecked later in unix_bind() and unix_find_other(), where
we can do the same processing. Moreover, in the BSD address case, the hash
is set to 0 but never used and confusing.
This patch moves the address tests out of unix_mkname(), and the following
patches move the other part into appropriate places and remove
unix_mkname() finally.
Signed-off-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxxxx>
Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
Stable-dep-of: a9bf9c7dc6a5 ("af_unix: Annotate data-race of sk->sk_state in unix_stream_connect().")
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 0a1258b417a9d..8aeafe66e6115 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -227,15 +227,22 @@ static inline void unix_release_addr(struct unix_address *addr)
* - if started by zero, it is abstract name.
*/
+static int unix_validate_addr(struct sockaddr_un *sunaddr, int addr_len)
+{
+ if (addr_len <= offsetof(struct sockaddr_un, sun_path) ||
+ addr_len > sizeof(*sunaddr))
+ return -EINVAL;
+
+ if (sunaddr->sun_family != AF_UNIX)
+ return -EINVAL;
+
+ return 0;
+}
+
static int unix_mkname(struct sockaddr_un *sunaddr, int len, unsigned int *hashp)
{
*hashp = 0;
- if (len <= offsetof(struct sockaddr_un, sun_path) ||
- len > sizeof(*sunaddr))
- return -EINVAL;
- if (!sunaddr || sunaddr->sun_family != AF_UNIX)
- return -EINVAL;
if (sunaddr->sun_path[0]) {
/*
* This may look like an off by one error but it is a bit more
@@ -1178,13 +1185,14 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
unsigned int hash;
struct unix_address *addr;
- if (addr_len < offsetofend(struct sockaddr_un, sun_family) ||
- sunaddr->sun_family != AF_UNIX)
- return -EINVAL;
-
- if (addr_len == offsetof(struct sockaddr_un, sun_path))
+ if (addr_len == offsetof(struct sockaddr_un, sun_path) &&
+ sunaddr->sun_family == AF_UNIX)
return unix_autobind(sk);
+ err = unix_validate_addr(sunaddr, addr_len);
+ if (err)
+ return err;
+
err = unix_mkname(sunaddr, addr_len, &hash);
if (err < 0)
return err;
@@ -1245,6 +1253,10 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
goto out;
if (addr->sa_family != AF_UNSPEC) {
+ err = unix_validate_addr(sunaddr, alen);
+ if (err)
+ goto out;
+
err = unix_mkname(sunaddr, alen, &hash);
if (err < 0)
goto out;
@@ -1365,6 +1377,10 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
int err;
long timeo;
+ err = unix_validate_addr(sunaddr, addr_len);
+ if (err)
+ goto out;
+
err = unix_mkname(sunaddr, addr_len, &hash);
if (err < 0)
goto out;
@@ -1817,6 +1833,10 @@ static int unix_dgram_sendmsg(struct socket *sock, struct msghdr *msg,
goto out;
if (msg->msg_namelen) {
+ err = unix_validate_addr(sunaddr, msg->msg_namelen);
+ if (err)
+ goto out;
+
err = unix_mkname(sunaddr, msg->msg_namelen, &hash);
if (err < 0)
goto out;
