[src/trunk]: src/sys RIP, RIP6, DDP, SCTP and SCTP6 lack a length check in th...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/68fd7e8cbc9b
branches:  trunk
changeset: 449140:68fd7e8cbc9b
user:      maxv <maxv%NetBSD.org@localhost>
date:      Sun Feb 24 07:20:33 2019 +0000

description:
RIP, RIP6, DDP, SCTP and SCTP6 lack a length check in their _connect()
functions. Fix the first three, and add a big XXX in the SCTP ones.

Found by KASAN, triggered by SyzKaller.

Reported-by: syzbot+9eaf98dad6ca738c250d%syzkaller.appspotmail.com@localhost

diffstat:

 sys/netatalk/ddp_usrreq.c   |  10 ++++++----
 sys/netinet/raw_ip.c        |   6 ++++--
 sys/netinet/sctp_usrreq.c   |   9 +++++++--
 sys/netinet6/raw_ip6.c      |   6 ++++--
 sys/netinet6/sctp6_usrreq.c |   9 +++++++--
 5 files changed, 28 insertions(+), 12 deletions(-)

diffs (148 lines):

diff -r e2a66ceec2a6 -r 68fd7e8cbc9b sys/netatalk/ddp_usrreq.c
--- a/sys/netatalk/ddp_usrreq.c Sun Feb 24 02:30:38 2019 +0000
+++ b/sys/netatalk/ddp_usrreq.c Sun Feb 24 07:20:33 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ddp_usrreq.c,v 1.72 2019/01/28 12:53:01 martin Exp $    */
+/*     $NetBSD: ddp_usrreq.c,v 1.73 2019/02/24 07:20:33 maxv Exp $      */
 
 /*
  * Copyright (c) 1990,1991 Regents of The University of Michigan.
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ddp_usrreq.c,v 1.72 2019/01/28 12:53:01 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ddp_usrreq.c,v 1.73 2019/02/24 07:20:33 maxv Exp $");
 
 #include "opt_mbuftrace.h"
 #include "opt_atalk.h"
@@ -185,9 +185,11 @@
        struct ifnet   *ifp;
        u_short         hintnet = 0, net;
 
-       if (sat->sat_family != AF_APPLETALK) {
+       if (sat->sat_family != AF_APPLETALK)
                return EAFNOSUPPORT;
-       }
+       if (sat->sat_len != sizeof(*sat))
+               return EINVAL;
+
        /*
          * Under phase 2, network 0 means "the network".  We take "the
          * network" to mean the network the control block is bound to.
diff -r e2a66ceec2a6 -r 68fd7e8cbc9b sys/netinet/raw_ip.c
--- a/sys/netinet/raw_ip.c      Sun Feb 24 02:30:38 2019 +0000
+++ b/sys/netinet/raw_ip.c      Sun Feb 24 07:20:33 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: raw_ip.c,v 1.178 2018/09/14 05:09:51 maxv Exp $        */
+/*     $NetBSD: raw_ip.c,v 1.179 2019/02/24 07:20:33 maxv Exp $        */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -65,7 +65,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: raw_ip.c,v 1.178 2018/09/14 05:09:51 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: raw_ip.c,v 1.179 2019/02/24 07:20:33 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -499,6 +499,8 @@
                return (EADDRNOTAVAIL);
        if (addr->sin_family != AF_INET)
                return (EAFNOSUPPORT);
+       if (addr->sin_len != sizeof(*addr))
+               return EINVAL;
        inp->inp_faddr = addr->sin_addr;
        return (0);
 }
diff -r e2a66ceec2a6 -r 68fd7e8cbc9b sys/netinet/sctp_usrreq.c
--- a/sys/netinet/sctp_usrreq.c Sun Feb 24 02:30:38 2019 +0000
+++ b/sys/netinet/sctp_usrreq.c Sun Feb 24 07:20:33 2019 +0000
@@ -1,5 +1,5 @@
 /*     $KAME: sctp_usrreq.c,v 1.50 2005/06/16 20:45:29 jinmei Exp $    */
-/*     $NetBSD: sctp_usrreq.c,v 1.16 2019/02/15 14:13:32 rjs Exp $     */
+/*     $NetBSD: sctp_usrreq.c,v 1.17 2019/02/24 07:20:33 maxv Exp $    */
 
 /*
  * Copyright (c) 2001, 2002, 2003, 2004 Cisco Systems, Inc.
@@ -33,7 +33,7 @@
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sctp_usrreq.c,v 1.16 2019/02/15 14:13:32 rjs Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sctp_usrreq.c,v 1.17 2019/02/24 07:20:33 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -3342,6 +3342,11 @@
                return (EINVAL);
        }
 #endif /* INET6 */
+
+       /*
+        * XXX XXX XXX Check nam->sa_len?
+        */
+
        if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) ==
            SCTP_PCB_FLAGS_UNBOUND) {
                /* Bind a ephemeral port */
diff -r e2a66ceec2a6 -r 68fd7e8cbc9b sys/netinet6/raw_ip6.c
--- a/sys/netinet6/raw_ip6.c    Sun Feb 24 02:30:38 2019 +0000
+++ b/sys/netinet6/raw_ip6.c    Sun Feb 24 07:20:33 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: raw_ip6.c,v 1.173 2019/01/28 12:53:01 martin Exp $     */
+/*     $NetBSD: raw_ip6.c,v 1.174 2019/02/24 07:20:33 maxv Exp $       */
 /*     $KAME: raw_ip6.c,v 1.82 2001/07/23 18:57:56 jinmei Exp $        */
 
 /*
@@ -62,7 +62,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: raw_ip6.c,v 1.173 2019/01/28 12:53:01 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: raw_ip6.c,v 1.174 2019/02/24 07:20:33 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_ipsec.h"
@@ -716,6 +716,8 @@
                return EADDRNOTAVAIL;
        if (addr->sin6_family != AF_INET6)
                return EAFNOSUPPORT;
+       if (addr->sin6_len != sizeof(*addr))
+               return EINVAL;
 
        /*
         * Application should provide a proper zone ID or the use of
diff -r e2a66ceec2a6 -r 68fd7e8cbc9b sys/netinet6/sctp6_usrreq.c
--- a/sys/netinet6/sctp6_usrreq.c       Sun Feb 24 02:30:38 2019 +0000
+++ b/sys/netinet6/sctp6_usrreq.c       Sun Feb 24 07:20:33 2019 +0000
@@ -1,5 +1,5 @@
 /* $KAME: sctp6_usrreq.c,v 1.38 2005/08/24 08:08:56 suz Exp $ */
-/* $NetBSD: sctp6_usrreq.c,v 1.17 2019/01/28 12:53:01 martin Exp $ */
+/* $NetBSD: sctp6_usrreq.c,v 1.18 2019/02/24 07:20:33 maxv Exp $ */
 
 /*
  * Copyright (c) 2001, 2002, 2003, 2004 Cisco Systems, Inc.
@@ -33,7 +33,7 @@
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sctp6_usrreq.c,v 1.17 2019/01/28 12:53:01 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sctp6_usrreq.c,v 1.18 2019/02/24 07:20:33 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -961,6 +961,11 @@
 
 #ifdef INET
        sin6 = (struct sockaddr_in6 *)nam;
+
+       /*
+        * XXX XXX XXX Check sin6->sin6_len?
+        */
+
        if (inp6->in6p_flags & IN6P_IPV6_V6ONLY) {
                /*
                 * if IPV6_V6ONLY flag, ignore connections