From ad00e629145b2b9f0d78aa46e204a9df7d628978 Mon Sep 17 00:00:00 2001 From: Tetsuo Handa Date: Sat, 13 Jul 2024 19:05:02 +0900 Subject: [PATCH] io_uring/net: check socket is valid in io_bind()/io_listen() We need to check that sock_from_file(req->file) != NULL. Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=1e811482aa2c70afa9a0 Fixes: 7481fd93fa0a ("io_uring: Introduce IORING_OP_BIND") Fixes: ff140cc8628a ("io_uring: Introduce IORING_OP_LISTEN") Signed-off-by: Tetsuo Handa Link: https://lore.kernel.org/r/903da529-eaa3-43ef-ae41-d30f376c60cc@I-love.SAKURA.ne.jp [axboe: move assignment of sock to where the NULL check is] Signed-off-by: Jens Axboe --- io_uring/net.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/io_uring/net.c b/io_uring/net.c index 25223e11958f..7ebbeab05fea 100644 --- a/io_uring/net.c +++ b/io_uring/net.c @@ -1747,9 +1747,14 @@ int io_bind(struct io_kiocb *req, unsigned int issue_flags) { struct io_bind *bind = io_kiocb_to_cmd(req, struct io_bind); struct io_async_msghdr *io = req->async_data; + struct socket *sock; int ret; - ret = __sys_bind_socket(sock_from_file(req->file), &io->addr, bind->addr_len); + sock = sock_from_file(req->file); + if (unlikely(!sock)) + return -ENOTSOCK; + + ret = __sys_bind_socket(sock, &io->addr, bind->addr_len); if (ret < 0) req_set_fail(req); io_req_set_res(req, ret, 0); @@ -1770,9 +1775,14 @@ int io_listen_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) int io_listen(struct io_kiocb *req, unsigned int issue_flags) { struct io_listen *listen = io_kiocb_to_cmd(req, struct io_listen); + struct socket *sock; int ret; - ret = __sys_listen_socket(sock_from_file(req->file), listen->backlog); + sock = sock_from_file(req->file); + if (unlikely(!sock)) + return -ENOTSOCK; + + ret = __sys_listen_socket(sock, listen->backlog); if (ret < 0) req_set_fail(req); io_req_set_res(req, ret, 0);