Skip to contentSkip to conversation

FAILED: patch "[PATCH] net: prevent address rewrite in kernel_bind()" failed to apply to 6.5-stable tree

PATCH [email protected] 1 participant 1 message Oct 7, 2023

Subsystems (6)
Networking Stable branch netfilter Sockets +2 more subsystems
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 6.5-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.5.y
git checkout FETCH_HEAD
git cherry-pick -x c889a99a21bf124c3db08d09df919f0eccc5ea4c
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2023100736-putdown-capitol-693a@gregkh' --subject-prefix 'PATCH 6.5.y' HEAD^..

Possible dependencies:

c889a99a21bf ("net: prevent address rewrite in kernel_bind()") 1ded5e5a5931 ("net: annotate data-races around sock->ops") 8936bf53a091 ("net: Use sockaddr_storage for getsockopt(SO_PEERNAME).")

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From c889a99a21bf124c3db08d09df919f0eccc5ea4c Mon Sep 17 00:00:00 2001
From: Jordan Rife <[email protected]>
Date: Thu, 21 Sep 2023 18:46:42 -0500
Subject: [PATCH] net: prevent address rewrite in kernel_bind()

Similar to the change in commit 0bdf399342c5("net: Avoid address overwrite in kernel_connect"), BPF hooks run on bind may rewrite the address passed to kernel_bind(). This change

1) Makes a copy of the bind address in kernel_bind() to insulate callers.
2) Replaces direct calls to sock->ops->bind() in net with kernel_bind()

Link https://lore.kernel.org/netdev/[email protected]/ open here
Fixes 4fbac77d2d09 ("bpf: Hooks for sys_bind")
Cc [email protected]
Reviewed-by Willem de Bruijn <[email protected]>
Signed-off-by Jordan Rife <[email protected]>
Reviewed-by Simon Horman <[email protected]>
Signed-off-by David S. Miller <[email protected]>
net/netfilter/ipvs/ip_vs_sync.c +2 -2
index 6e4ed1e11a3b..4174076c66fa 100644
@@ -1439,7 +1439,7 @@ static int bind_mcastif_addr(struct socket *sock, struct net_device *dev)
 	sin.sin_addr.s_addr  = addr;
 	sin.sin_port         = 0;
 
-	return sock->ops->bind(sock, (struct sockaddr*)&sin, sizeof(sin));
+	return kernel_bind(sock, (struct sockaddr *)&sin, sizeof(sin));
 }
 
 static void get_mcast_sockaddr(union ipvs_sockaddr *sa, int *salen,

@@ -1546,7 +1546,7 @@ static int make_receive_sock(struct netns_ipvs *ipvs, int id,
 
 	get_mcast_sockaddr(&mcast_addr, &salen, &ipvs->bcfg, id);
 	sock->sk->sk_bound_dev_if = dev->ifindex;
-	result = sock->ops->bind(sock, (struct sockaddr *)&mcast_addr, salen);
+	result = kernel_bind(sock, (struct sockaddr *)&mcast_addr, salen);
 	if (result < 0) {
 		pr_err("Error binding to the multicast addr\n");
 		goto error;
net/rds/tcp_connect.c +1 -1
index d788c6d28986..a0046e99d6df 100644
@@ -145,7 +145,7 @@ int rds_tcp_conn_path_connect(struct rds_conn_path *cp)
 		addrlen = sizeof(sin);
 	}
 
-	ret = sock->ops->bind(sock, addr, addrlen);
+	ret = kernel_bind(sock, addr, addrlen);
 	if (ret) {
 		rdsdebug("bind failed with %d at address %pI6c\n",
 			 ret, &conn->c_laddr);
net/rds/tcp_listen.c +1 -1
index 014fa24418c1..53b3535a1e4a 100644
@@ -306,7 +306,7 @@ struct socket *rds_tcp_listen_init(struct net *net, bool isv6)
 		addr_len = sizeof(*sin);
 	}
 
-	ret = sock->ops->bind(sock, (struct sockaddr *)&ss, addr_len);
+	ret = kernel_bind(sock, (struct sockaddr *)&ss, addr_len);
 	if (ret < 0) {
 		rdsdebug("could not bind %s listener socket: %d\n",
 			 isv6 ? "IPv6" : "IPv4", ret);
net/socket.c +6 -1
index a39ec136f5cf..c4a6f5532955 100644
@@ -3516,7 +3516,12 @@ static long compat_sock_ioctl(struct file *file, unsigned int cmd,
 
 int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
 {
-	return READ_ONCE(sock->ops)->bind(sock, addr, addrlen);
+	struct sockaddr_storage address;
+
+	memcpy(&address, addr, addrlen);
+
+	return READ_ONCE(sock->ops)->bind(sock, (struct sockaddr *)&address,
+					  addrlen);
 }
 EXPORT_SYMBOL(kernel_bind);