[PATCH] v9fs: fix a problem with named-pipe transport

[Eric Van Hensbergen]

[PATCH] v9fs: fix a problem with named-pipe transport

Found the problem. I am not sure why, but unix_mkname in
net/unix/af_unix.c writes a zero byte outside the sockaddr_un parameter.
There is even a comment that it might seem like a bug, but it is not --
I didn't understand the explanation -- it looks like a bug to me :)

The patch that I am attaching sets addr_len parameter of ops->connect to
sizeof(struct sockaddr_un) - 1 and thus ensures that unix_mkname won't
write outside the struct. The patch also checks if the length of the
unix
socket name specified in mount doesn't exceed UNIX_PATH_MAX.

Signed-off-by: Latchesar Ionkov <lucho@xxxxxxxxxx>
Signed-off-by: Eric Van Hensbergen <ericvh@xxxxxxxxx>

---
commit f32fc66e311abe9e7167991e6b2d37e7c56dcc72
tree 3b2a77e0c674e86aed92823857d33352d93938f3
parent 97bc19b509356dda0145cd19fb9768ac3c88ecda
author Eric Van Hensbergen <ericvh@xxxxxxxxx> Sun, 28 Aug 2005 13:29:03
-0500
committer Eric Van Hensbergen <ericvh@xxxxxxxxx> Sun, 28 Aug 2005
13:29:03 -0500

 fs/9p/trans_sock.c |   24 ++++++++++++++++--------
 1 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/fs/9p/trans_sock.c b/fs/9p/trans_sock.c
--- a/fs/9p/trans_sock.c
+++ b/fs/9p/trans_sock.c
@@ -202,14 +202,23 @@ static int
 v9fs_unix_init(struct v9fs_session_info *v9ses, const char *dev_name,
 	       char *data)
 {
-	struct socket *csocket = NULL;
+	int rc;
+	struct socket *csocket;
 	struct sockaddr_un sun_server;
-	struct v9fs_transport *trans = v9ses->transport;
-	int rc = 0;
+	struct v9fs_transport *trans;
+	struct v9fs_trans_sock *ts;
 
-	struct v9fs_trans_sock *ts =
-	    kmalloc(sizeof(struct v9fs_trans_sock), GFP_KERNEL);
+	rc = 0;
+	csocket = NULL;
+	trans = v9ses->transport;
+
+	if (strlen(dev_name) > UNIX_PATH_MAX) {
+		eprintk(KERN_ERR, "v9fs_trans_unix: address too long: %s\n",
+			dev_name);
+		return -ENOMEM;
+	}
 
+	ts = kmalloc(sizeof(struct v9fs_trans_sock), GFP_KERNEL);
 	if (!ts)
 		return -ENOMEM;
 
@@ -222,9 +231,8 @@ v9fs_unix_init(struct v9fs_session_info 
 	sun_server.sun_family = PF_UNIX;
 	strcpy(sun_server.sun_path, dev_name);
 	sock_create_kern(PF_UNIX, SOCK_STREAM, 0, &csocket);
-	rc = csocket->ops->connect(csocket,
-				   (struct sockaddr *)&sun_server,
-				   sizeof(struct sockaddr_un), 0);
+	rc = csocket->ops->connect(csocket, (struct sockaddr *)&sun_server, 
+		sizeof(struct sockaddr_un) - 1, 0);	/* -1 *is* important */
 	if (rc < 0) {
 		eprintk(KERN_ERR,
 			"v9fs_trans_unix: problem connecting socket: %s: %d\n",


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/