rxrpc: Fix send on a connected, but unbound socket [Linux 4.9.187]

This Linux kernel change "rxrpc: Fix send on a connected, but unbound socket" is included in the Linux 4.9.187 release. This change is authored by David Howells <dhowells [at] redhat.com> on Tue Jul 2 15:59:12 2019 +0100. The commit for this change in Linux stable tree is c382eaf (patch) which is from upstream commit e835ada. The same Linux upstream change may have been applied to various maintained Linux releases and you can find all Linux releases containing changes from upstream e835ada.

rxrpc: Fix send on a connected, but unbound socket

[ Upstream commit e835ada07091f40dcfb1bc735082bd0a7c005e59 ]

If sendmsg() or sendmmsg() is called on a connected socket that hasn't had
bind() called on it, then an oops will occur when the kernel tries to
connect the call because no local endpoint has been allocated.

Fix this by implicitly binding the socket if it is in the
RXRPC_CLIENT_UNBOUND state, just like it does for the RXRPC_UNBOUND state.

Further, the state should be transitioned to RXRPC_CLIENT_BOUND after this
to prevent further attempts to bind it.

This can be tested with:

    #include <stdio.h>
    #include <stdlib.h>
    #include <string.h>
    #include <sys/socket.h>
    #include <arpa/inet.h>
    #include <linux/rxrpc.h>
    static const unsigned char inet6_addr[16] = {
        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -1, -1, 0xac, 0x14, 0x14, 0xaa
    int main(void)
        struct sockaddr_rxrpc srx;
        struct cmsghdr *cm;
        struct msghdr msg;
        unsigned char control[16];
        int fd;
        memset(&srx, 0, sizeof(srx));
        srx.srx_family = 0x21;
        srx.srx_service = 0;
        srx.transport_type = AF_INET;
        srx.transport_len = 0x1c;
        srx.transport.sin6.sin6_family = AF_INET6;
        srx.transport.sin6.sin6_port = htons(0x4e22);
        srx.transport.sin6.sin6_flowinfo = htons(0x4e22);
        srx.transport.sin6.sin6_scope_id = htons(0xaa3b);
        memcpy(&srx.transport.sin6.sin6_addr, inet6_addr, 16);
        cm = (struct cmsghdr *)control;
        cm->cmsg_len    = CMSG_LEN(sizeof(unsigned long));
        cm->cmsg_level  = SOL_RXRPC;
        cm->cmsg_type   = RXRPC_USER_CALL_ID;
        *(unsigned long *)CMSG_DATA(cm) = 0;
        msg.msg_name = NULL;
        msg.msg_namelen = 0;
        msg.msg_iov = NULL;
        msg.msg_iovlen = 0;
        msg.msg_control = control;
        msg.msg_controllen = cm->cmsg_len;
        msg.msg_flags = 0;
        fd = socket(AF_RXRPC, SOCK_DGRAM, AF_INET);
        connect(fd, (struct sockaddr *)&srx, sizeof(srx));
        sendmsg(fd, &msg, 0);
        return 0;

Leading to the following oops:

    BUG: kernel NULL pointer dereference, address: 0000000000000018
    #PF: supervisor read access in kernel mode
    #PF: error_code(0x0000) - not-present page
    RIP: 0010:rxrpc_connect_call+0x42/0xa01
    Call Trace:
     ? mark_held_locks+0x47/0x59
     ? __local_bh_enable_ip+0xb6/0xba
     ? rxrpc_do_sendmsg+0x3c0/0x92e
     ? release_sock+0x19/0x9e
     ? reacquire_held_locks+0x136/0x160
     ? release_sock+0x19/0x9e
     ? find_held_lock+0x2b/0x6e
     ? __lock_acquire+0x268/0xf73
     ? rxrpc_connect+0xdd/0xe4
     ? __local_bh_enable_ip+0xb6/0xba

Fixes: 2341e0775747 ("rxrpc: Simplify connect() implementation and simplify sendmsg() op")
Reported-by: syzbot+7966f2a0b2c7da8939b4@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

There are 4 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 net/rxrpc/af_rxrpc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 2d59c9b..222c566 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -405,6 +405,7 @@ static int rxrpc_sendmsg(struct socket *sock, struct msghdr *m, size_t len)

    switch (rx->sk.sk_state) {
        rx->srx.srx_family = AF_RXRPC;
        rx->srx.srx_service = 0;
        rx->srx.transport_type = SOCK_DGRAM;
@@ -429,10 +430,9 @@ static int rxrpc_sendmsg(struct socket *sock, struct msghdr *m, size_t len)

        rx->local = local;
-       rx->sk.sk_state = RXRPC_CLIENT_UNBOUND;
+       rx->sk.sk_state = RXRPC_CLIENT_BOUND;
        /* Fall through */

        if (!m->msg_name &&
            test_bit(RXRPC_SOCK_CONNECTED, &rx->flags)) {

Leave a Reply

Your email address will not be published. Required fields are marked *