linux-kernel - Re: [PATCH] net: check passed optlen before reading

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJ-ks9=41PuzGkXmi0-aZPEWicWJ5s2gW2zL+jSHuDjaJ5Lhsg@mail.gmail.com>
Date:   Tue, 28 Dec 2021 16:02:29 -0500
From:   Tamir Duberstein <tamird@...il.com>
To:     netdev@...r.kernel.org
Cc:     "David S. Miller" <davem@...emloft.net>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        David Ahern <dsahern@...nel.org>,
        Jakub Kicinski <kuba@...nel.org>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] net: check passed optlen before reading

Errant brace in the earlier version.

>From 8586be4d72c6c583b1085d2239076987e1b7c43a Mon Sep 17 00:00:00 2001
From: Tamir Duberstein <tamird@...il.com>
Date: Tue, 28 Dec 2021 15:09:11 -0500
Subject: [PATCH v2] net: check passed optlen before reading

Add a check that the user-provided option is at least as long as the
number of bytes we intend to read. Before this patch we would blindly
read sizeof(int) bytes even in cases where the user passed
optlen<sizeof(int), which would potentially read garbage or fault.

Discovered by new tests in https://github.com/google/gvisor/pull/6957 .

Signed-off-by: Tamir Duberstein <tamird@...il.com>
---
 net/ipv6/raw.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 60f1e4f5be5a..c51d5ce3711c 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1020,6 +1020,9 @@ static int do_rawv6_setsockopt(struct sock *sk,
int level, int optname,
        struct raw6_sock *rp = raw6_sk(sk);
        int val;

+       if (optlen < sizeof(val))
+               return -EINVAL;
+
        if (copy_from_sockptr(&val, optval, sizeof(val)))
                return -EFAULT;

-- 
2.34.1.448.ga2b2bfdf31-goog

On Tue, Dec 28, 2021 at 3:18 PM Tamir Duberstein <tamird@...il.com> wrote:
>
> From 52e464972f88ff5e9647d92b63c815e1f350f65e Mon Sep 17 00:00:00 2001
> From: Tamir Duberstein <tamird@...il.com>
> Date: Tue, 28 Dec 2021 15:09:11 -0500
> Subject: [PATCH] net: check passed optlen before reading
>
> Add a check that the user-provided option is at least as long as the
> number of bytes we intend to read. Before this patch we would blindly
> read sizeof(int) bytes even in cases where the user passed
> optlen<sizeof(int), which would potentially read garbage or fault.
>
> Discovered by new tests in https://github.com/google/gvisor/pull/6957.
>
> Signed-off-by: Tamir Duberstein <tamird@...il.com>
> ---
>  net/ipv6/raw.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
> index 60f1e4f5be5a..547613058182 100644
> --- a/net/ipv6/raw.c
> +++ b/net/ipv6/raw.c
> @@ -1020,6 +1020,9 @@ static int do_rawv6_setsockopt(struct sock *sk,
> int level, int optname,
>         struct raw6_sock *rp = raw6_sk(sk);
>         int val;
>
> +       if (optlen < sizeof(val)) {
> +               return -EINVAL;
> +
>         if (copy_from_sockptr(&val, optval, sizeof(val)))
>                 return -EFAULT;
>
> --
> 2.34.1.448.ga2b2bfdf31-goog