summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorShuah Khan <skhan@linuxfoundation.org>2021-03-08 06:53:27 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2021-03-10 21:32:33 +0300
commitf55a0571690c4aae03180e001522538c0927432f (patch)
treeddc1290479bb7f250e85cd05e7ee354a54769329
parent47ccc8fc2c9c94558b27b6f9e2582df32d29e6e8 (diff)
downloadlinux-f55a0571690c4aae03180e001522538c0927432f.tar.xz
usbip: fix vhci_hcd to check for stream socket
Fix attach_store() to validate the passed in file descriptor is a stream socket. If the file descriptor passed was a SOCK_DGRAM socket, sock_recvmsg() can't detect end of stream. Cc: stable@vger.kernel.org Suggested-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> Link: https://lore.kernel.org/r/52712aa308915bda02cece1589e04ee8b401d1f3.1615171203.git.skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/usb/usbip/vhci_sysfs.c10
1 files changed, 9 insertions, 1 deletions
diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c
index 96e5371dc335..1e1ae9bd06ab 100644
--- a/drivers/usb/usbip/vhci_sysfs.c
+++ b/drivers/usb/usbip/vhci_sysfs.c
@@ -349,8 +349,16 @@ static ssize_t attach_store(struct device *dev, struct device_attribute *attr,
/* Extract socket from fd. */
socket = sockfd_lookup(sockfd, &err);
- if (!socket)
+ if (!socket) {
+ dev_err(dev, "failed to lookup sock");
return -EINVAL;
+ }
+ if (socket->type != SOCK_STREAM) {
+ dev_err(dev, "Expecting SOCK_STREAM - found %d",
+ socket->type);
+ sockfd_put(socket);
+ return -EINVAL;
+ }
/* now need lock until setting vdev status as used */