From nobody Mon Jun 8 15:38:06 2026 Received: from pdx-out-001.esa.us-west-2.outbound.mail-perimeter.amazon.com (pdx-out-001.esa.us-west-2.outbound.mail-perimeter.amazon.com [44.245.243.92]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EB2273E63B0; Thu, 28 May 2026 12:14:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=44.245.243.92 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779970498; cv=none; b=mHfxZLFagdnLKHrMylWSWSDLPrmtQG+9gwIMEemtzPefpumzLuZqXnReI2JFCvvO0zYJvaVnkMLWcYlc3uus1QYHOSNYIfIq43BC1WeKKyVHhxFFE/QncwRNE7ivo1bqg4s6yP3xPad6EzzYlOQQi+Vwh0alAzI1XRm7PbKqALY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779970498; c=relaxed/simple; bh=6yB1rbQ4UA0J6bF6ZQjxAsIMRYJAIlzNKhnmHJVD3oU=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=ZZMHJehI1/BfIjT5BO9GD+JlkFvx2rcSXJNuZiDje3R0CD0RsyD464wnJwMhryue4JqZoFf8IDRhHE6BdbMp5TPYj6zoWzsaYbmXGY9wUIlVQDxb5St+h1CvZhSg2woVRtkU99EjG3N9B8dQibFYO4AVpig00mSOMnqiCzrRJrA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.de; spf=pass smtp.mailfrom=amazon.de; dkim=pass (2048-bit key) header.d=amazon.de header.i=@amazon.de header.b=kcQEsBYx; arc=none smtp.client-ip=44.245.243.92 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=amazon.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=amazon.de header.i=@amazon.de header.b="kcQEsBYx" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.de; i=@amazon.de; q=dns/txt; s=amazoncorp2; t=1779970496; x=1811506496; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=6yB1rbQ4UA0J6bF6ZQjxAsIMRYJAIlzNKhnmHJVD3oU=; b=kcQEsBYxQUEury/FpI9wZBkIkNwfJxh2KfXhaykhofqErXY7JHPc0G+0 gfayd99FruIkrpGdc0h88dDdiYgDe9AvF3BtNwLRKV8r6wuoIcFxTVLEK YE0XXwymolMqgi5y0QnSp57rrE2yCJb3V8s87a0vKCiRmOI7KvQ0Nh6fv Pi51ogYt2AgHxsN5Zsp+HGL0aVFzGbKfK8YEKdJtrS6vIWc5NDIE+lqP5 XFoApWsPkk5UA1KuvMrkcXO1dsSyqSDl5xdYC7brX1XY9Ee//BWQshtlT 4khkIltCEnHmVI+P9WSfpXcNuXn6p+hiQvw1oJqVYi73QDXa8pgbJQdEq g==; X-CSE-ConnectionGUID: Zxt4rgX8Siq40/4xh09aqQ== X-CSE-MsgGUID: mvToXaZnT1ivvaI4CeS3pQ== X-IronPort-AV: E=Sophos;i="6.24,173,1774310400"; d="scan'208";a="20141489" Received: from ip-10-5-6-203.us-west-2.compute.internal (HELO smtpout.naws.us-west-2.prod.farcaster.email.amazon.dev) ([10.5.6.203]) by internal-pdx-out-001.esa.us-west-2.outbound.mail-perimeter.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 28 May 2026 12:14:54 +0000 Received: from EX19MTAUWB002.ant.amazon.com [205.251.233.111:8267] by smtpin.naws.us-west-2.prod.farcaster.email.amazon.dev [10.0.6.91:2525] with esmtp (Farcaster) id dee1f4c1-d981-4fe6-b308-096a6ba05a14; Thu, 28 May 2026 12:14:53 +0000 (UTC) X-Farcaster-Flow-ID: dee1f4c1-d981-4fe6-b308-096a6ba05a14 Received: from EX19D001UWA001.ant.amazon.com (10.13.138.214) by EX19MTAUWB002.ant.amazon.com (10.250.64.231) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.37; Thu, 28 May 2026 12:14:53 +0000 Received: from dev-dsk-mheyne-1b-8cc83676.eu-west-1.amazon.com (10.13.235.223) by EX19D001UWA001.ant.amazon.com (10.13.138.214) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.37; Thu, 28 May 2026 12:14:51 +0000 From: Maximilian Heyne To: CC: Maximilian Heyne , Matthieu Buffet , =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= , =?UTF-8?q?G=C3=BCnther=20Noack?= , Paul Moore , James Morris , "Serge E. Hallyn" , Konstantin Meskhidze , , Subject: [PATCH 6.12.y] landlock: Fix TCP handling of short AF_UNSPEC addresses Date: Thu, 28 May 2026 12:14:26 +0000 Message-ID: <20260528-spice-spiral-4cde3d3b@mheyne-amazon> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ClientProxiedBy: EX19D036UWC002.ant.amazon.com (10.13.139.242) To EX19D001UWA001.ant.amazon.com (10.13.138.214) Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Matthieu Buffet [ Upstream commit e4d82cbce2258f454634307fdabf33aa46b61ab0 ] current_check_access_socket() treats AF_UNSPEC addresses as AF_INET ones, and only later adds special case handling to allow connect(AF_UNSPEC), and on IPv4 sockets bind(AF_UNSPEC+INADDR_ANY). This would be fine except AF_UNSPEC addresses can be as short as a bare AF_UNSPEC sa_family_t field, and nothing more. The AF_INET code path incorrectly enforces a length of sizeof(struct sockaddr_in) instead. Move AF_UNSPEC edge case handling up inside the switch-case, before the address is (potentially incorrectly) treated as AF_INET. Fixes: fff69fb03dde ("landlock: Support network rules with TCP bind and con= nect") Signed-off-by: Matthieu Buffet Link: https://lore.kernel.org/r/20251027190726.626244-4-matthieu@buffet.re Signed-off-by: Micka=C3=ABl Sala=C3=BCn [ There was a conflict due to missing commit 9f74411a40ce ("landlock: Log TCP bind and connect denials") ] Signed-off-by: Maximilian Heyne --- Backporting this because landlock/net_test deterministically fails as the selftest from the patch series "Fix TCP short AF_UNSPEC handling" (https://lore.kernel.org/all/20251027190726.626244-1-matthieu@buffet.re/) has been backported to 6.12 but not this patch due to conflicts. --- security/landlock/net.c | 118 +++++++++++++++++++++++----------------- 1 file changed, 67 insertions(+), 51 deletions(-) diff --git a/security/landlock/net.c b/security/landlock/net.c index 104b6c01fe503..53d479893475f 100644 --- a/security/landlock/net.c +++ b/security/landlock/net.c @@ -72,6 +72,61 @@ static int current_check_access_socket(struct socket *co= nst sock, =20 switch (address->sa_family) { case AF_UNSPEC: + if (access_request =3D=3D LANDLOCK_ACCESS_NET_CONNECT_TCP) { + /* + * Connecting to an address with AF_UNSPEC dissolves + * the TCP association, which have the same effect as + * closing the connection while retaining the socket + * object (i.e., the file descriptor). As for dropping + * privileges, closing connections is always allowed. + * + * For a TCP access control system, this request is + * legitimate. Let the network stack handle potential + * inconsistencies and return -EINVAL if needed. + */ + return 0; + } else if (access_request =3D=3D LANDLOCK_ACCESS_NET_BIND_TCP) { + /* + * Binding to an AF_UNSPEC address is treated + * differently by IPv4 and IPv6 sockets. The socket's + * family may change under our feet due to + * setsockopt(IPV6_ADDRFORM), but that's ok: we either + * reject entirely or require + * %LANDLOCK_ACCESS_NET_BIND_TCP for the given port, so + * it cannot be used to bypass the policy. + * + * IPv4 sockets map AF_UNSPEC to AF_INET for + * retrocompatibility for bind accesses, only if the + * address is INADDR_ANY (cf. __inet_bind). IPv6 + * sockets always reject it. + * + * Checking the address is required to not wrongfully + * return -EACCES instead of -EAFNOSUPPORT or -EINVAL. + * We could return 0 and let the network stack handle + * these checks, but it is safer to return a proper + * error and test consistency thanks to kselftest. + */ + if (sock->sk->__sk_common.skc_family =3D=3D AF_INET) { + const struct sockaddr_in *const sockaddr =3D + (struct sockaddr_in *)address; + + if (addrlen < sizeof(struct sockaddr_in)) + return -EINVAL; + + if (sockaddr->sin_addr.s_addr !=3D + htonl(INADDR_ANY)) + return -EAFNOSUPPORT; + } else { + if (addrlen < SIN6_LEN_RFC2133) + return -EINVAL; + else + return -EAFNOSUPPORT; + } + } else { + WARN_ON_ONCE(1); + } + /* Only for bind(AF_UNSPEC+INADDR_ANY) on IPv4 socket. */ + fallthrough; case AF_INET: if (addrlen < sizeof(struct sockaddr_in)) return -EINVAL; @@ -90,57 +145,18 @@ static int current_check_access_socket(struct socket *= const sock, return 0; } =20 - /* Specific AF_UNSPEC handling. */ - if (address->sa_family =3D=3D AF_UNSPEC) { - /* - * Connecting to an address with AF_UNSPEC dissolves the TCP - * association, which have the same effect as closing the - * connection while retaining the socket object (i.e., the file - * descriptor). As for dropping privileges, closing - * connections is always allowed. - * - * For a TCP access control system, this request is legitimate. - * Let the network stack handle potential inconsistencies and - * return -EINVAL if needed. - */ - if (access_request =3D=3D LANDLOCK_ACCESS_NET_CONNECT_TCP) - return 0; - - /* - * For compatibility reason, accept AF_UNSPEC for bind - * accesses (mapped to AF_INET) only if the address is - * INADDR_ANY (cf. __inet_bind). Checking the address is - * required to not wrongfully return -EACCES instead of - * -EAFNOSUPPORT. - * - * We could return 0 and let the network stack handle these - * checks, but it is safer to return a proper error and test - * consistency thanks to kselftest. - */ - if (access_request =3D=3D LANDLOCK_ACCESS_NET_BIND_TCP) { - /* addrlen has already been checked for AF_UNSPEC. */ - const struct sockaddr_in *const sockaddr =3D - (struct sockaddr_in *)address; - - if (sock->sk->__sk_common.skc_family !=3D AF_INET) - return -EINVAL; - - if (sockaddr->sin_addr.s_addr !=3D htonl(INADDR_ANY)) - return -EAFNOSUPPORT; - } - } else { - /* - * Checks sa_family consistency to not wrongfully return - * -EACCES instead of -EINVAL. Valid sa_family changes are - * only (from AF_INET or AF_INET6) to AF_UNSPEC. - * - * We could return 0 and let the network stack handle this - * check, but it is safer to return a proper error and test - * consistency thanks to kselftest. - */ - if (address->sa_family !=3D sock->sk->__sk_common.skc_family) - return -EINVAL; - } + /* + * Checks sa_family consistency to not wrongfully return + * -EACCES instead of -EINVAL. Valid sa_family changes are + * only (from AF_INET or AF_INET6) to AF_UNSPEC. + * + * We could return 0 and let the network stack handle this + * check, but it is safer to return a proper error and test + * consistency thanks to kselftest. + */ + if (address->sa_family !=3D sock->sk->__sk_common.skc_family && + address->sa_family !=3D AF_UNSPEC) + return -EINVAL; =20 id.key.data =3D (__force uintptr_t)port; BUILD_BUG_ON(sizeof(port) > sizeof(id.key.data)); --=20 2.50.1 Amazon Web Services Development Center Germany GmbH Tamara-Danz-Str. 13 10243 Berlin Geschaeftsfuehrung: Christof Hellmis, Andreas Stieger Eingetragen am Amtsgericht Charlottenburg unter HRB 257764 B Sitz: Berlin Ust-ID: DE 365 538 597