diff mbox series

[4.9,39/78] usbip: fix stub_dev to check for stream socket

Message ID	20210315135213.353298819@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: gregkh@linuxfoundation.org To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>, Shuah Khan <skhan@linuxfoundation.org> Subject: [PATCH 4.9 39/78] usbip: fix stub_dev to check for stream socket Date: Mon, 15 Mar 2021 14:52:02 +0100 Message-Id: <20210315135213.353298819@linuxfoundation.org> In-Reply-To: <20210315135212.060847074@linuxfoundation.org> References: <20210315135212.060847074@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [4.9,03/78] ath9k: fix transmitting to stations in dynamic SMPS mode [4.9,04/78] net: Fix gro aggregation for udp encaps with zero csum [4.9,05/78] net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0 [4.9,06/78] can: skb: can_skb_set_owner(): fix ref counting if socket was closed before setting s... [4.9,12/78] net/mlx4_en: update moderation when config reset [4.9,13/78] net: sched: avoid duplicates in classes dump [4.9,15/78] net: davicom: Fix regulator not turned off on failed probe [4.9,18/78] udf: fix silent AED tagLocation corruption [4.9,21/78] powerpc/perf: Record counter overflow always if SAMPLE_IP is unset [4.9,22/78] PCI: xgene-msi: Fix race in installing chained irq handler [4.9,23/78] s390/smp: __smp_rescan_cpus() - move cpumask away from stack [4.9,25/78] ALSA: hda/hdmi: Cancel pending works before suspend [4.9,27/78] ALSA: usb-audio: Fix "cannot get freq eq" errors on Dell AE515 sound bar [4.9,28/78] s390/dasd: fix hanging DASD driver unbind [4.9,32/78] usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio slot [4.9,34/78] xhci: Improve detection of device initiated wake signal. [4.9,35/78] USB: serial: io_edgeport: fix memory leak in edge_startup [4.9,38/78] USB: serial: cp210x: add some more GE USB IDs [4.9,39/78] usbip: fix stub_dev to check for stream socket [4.9,43/78] usbip: fix vhci_hcd attach_store() races leading to gpf [4.9,45/78] staging: rtl8188eu: prevent ->ssid overflow in rtw_wx_set_scan() [4.9,46/78] staging: rtl8712: unterminated string leads to read overflow [4.9,47/78] staging: rtl8188eu: fix potential memory corruption in rtw_check_beacon_data() [4.9,48/78] staging: ks7010: prevent buffer overflow in ks_wlan_set_scan() [4.9,50/78] staging: rtl8192e: Fix possible buffer overflow in _rtl92e_wx_set_scan [4.9,51/78] staging: comedi: addi_apci_1032: Fix endian problem for COS sample [4.9,52/78] staging: comedi: addi_apci_1500: Fix endian problem for command sample [4.9,53/78] staging: comedi: adv_pci1710: Fix endian problem for AI command data [4.9,54/78] staging: comedi: das6402: Fix endian problem for AI command data [4.9,56/78] staging: comedi: dmm32at: Fix endian problem for AI command data [4.9,58/78] staging: comedi: pcl711: Fix endian problem for AI command data [4.9,59/78] staging: comedi: pcl818: Fix endian problem for AI command data [4.9,63/78] configfs: fix a use-after-free in __configfs_open_file [4.9,65/78] alpha: add $(src)/ rather than $(obj)/ to make source file path [4.9,66/78] alpha: merge build rules of division routines [4.9,67/78] alpha: make short build log available for division routines [4.9,68/78] alpha: Package string routines together [4.9,69/78] alpha: switch __copy_user() and __do_clean_user() to normal calling conventions [4.9,70/78] powerpc/64s: Fix instruction encoding for lis in ppc_function_entry() [4.9,72/78] hwmon: (lm90) Fix max6658 sporadic wrong temperature reading [4.9,73/78] KVM: arm64: Fix exclusive limit for IPA size [4.9,75/78] iio: imu: adis16400: fix memory leak [4.9,78/78] xen/events: avoid handling the same event on two cpus at the same time

Commit Message

Greg KH March 15, 2021, 1:52 p.m. UTC

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

From: Shuah Khan <skhan@linuxfoundation.org>

commit 47ccc8fc2c9c94558b27b6f9e2582df32d29e6e8 upstream.

Fix usbip_sockfd_store() to validate the passed in file descriptor is
a stream socket. If the file descriptor passed was a SOCK_DGRAM socket,
sock_recvmsg() can't detect end of stream.

Cc: stable@vger.kernel.org
Suggested-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/e942d2bd03afb8e8552bd2a5d84e18d17670d521.1615171203.git.skhan@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/usbip/stub_dev.c |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff mbox series

Patch

--- a/drivers/usb/usbip/stub_dev.c
+++ b/drivers/usb/usbip/stub_dev.c
@@ -83,8 +83,16 @@  static ssize_t store_sockfd(struct devic
 		}
 
 		socket = sockfd_lookup(sockfd, &err);
-		if (!socket)
+		if (!socket) {
+			dev_err(dev, "failed to lookup sock");
 			goto err;
+		}
+
+		if (socket->type != SOCK_STREAM) {
+			dev_err(dev, "Expecting SOCK_STREAM - found %d",
+				socket->type);
+			goto sock_err;
+		}
 
 		sdev->ud.tcp_socket = socket;
 		sdev->ud.sockfd = sockfd;
@@ -114,6 +122,8 @@  static ssize_t store_sockfd(struct devic
 
 	return count;
 
+sock_err:
+	sockfd_put(socket);
 err:
 	spin_unlock_irq(&sdev->ud.lock);
 	return -EINVAL;