diff options
| author | Shuah Khan <skhan@linuxfoundation.org> | 2021-03-07 20:53:26 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-03-10 19:32:33 +0100 |
| commit | 47ccc8fc2c9c94558b27b6f9e2582df32d29e6e8 (patch) | |
| tree | 701d8fac69f69ba0a1212acf18da812e061fd8d3 /drivers/usb/usbip/stub_dev.c | |
| parent | 1cffb1c66499a9db9a735473778abf8427d16287 (diff) | |
| download | lwn-47ccc8fc2c9c94558b27b6f9e2582df32d29e6e8.tar.gz lwn-47ccc8fc2c9c94558b27b6f9e2582df32d29e6e8.zip | |
usbip: fix stub_dev to check for stream socket
Fix usbip_sockfd_store() to validate the passed in file descriptor is
a stream socket. If the file descriptor passed was a SOCK_DGRAM socket,
sock_recvmsg() can't detect end of stream.
Cc: stable@vger.kernel.org
Suggested-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/e942d2bd03afb8e8552bd2a5d84e18d17670d521.1615171203.git.skhan@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/usbip/stub_dev.c')
| -rw-r--r-- | drivers/usb/usbip/stub_dev.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c index 2305d425e6c9..90c105469a07 100644 --- a/drivers/usb/usbip/stub_dev.c +++ b/drivers/usb/usbip/stub_dev.c @@ -69,8 +69,16 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a } socket = sockfd_lookup(sockfd, &err); - if (!socket) + if (!socket) { + dev_err(dev, "failed to lookup sock"); goto err; + } + + if (socket->type != SOCK_STREAM) { + dev_err(dev, "Expecting SOCK_STREAM - found %d", + socket->type); + goto sock_err; + } sdev->ud.tcp_socket = socket; sdev->ud.sockfd = sockfd; @@ -100,6 +108,8 @@ static ssize_t usbip_sockfd_store(struct device *dev, struct device_attribute *a return count; +sock_err: + sockfd_put(socket); err: spin_unlock_irq(&sdev->ud.lock); return -EINVAL; |