lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 21 Feb 2024 22:44:32 +0000
From: David Laight <David.Laight@...LAB.COM>
To: 'Marc Kleine-Budde' <mkl@...gutronix.de>, Oliver Hartkopp
	<socketcan@...tkopp.net>, "David S. Miller" <davem@...emloft.net>, "Eric
 Dumazet" <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni
	<pabeni@...hat.com>
CC: "linux-can@...r.kernel.org" <linux-can@...r.kernel.org>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH] can: raw: raw_getsockopt(): reduce scope of err

From: Marc Kleine-Budde
> Sent: 20 February 2024 08:16
> 
> Reduce the scope of the variable "err" to the individual cases. This
> is to avoid the mistake of setting "err" in the mistaken belief that
> it will be evaluated later.
> 
> Signed-off-by: Marc Kleine-Budde <mkl@...gutronix.de>
> ---
>  net/can/raw.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
> 
> diff --git a/net/can/raw.c b/net/can/raw.c
> index 897ffc17d850..2bb3eab98af0 100644
> --- a/net/can/raw.c
> +++ b/net/can/raw.c
> @@ -756,7 +756,6 @@ static int raw_getsockopt(struct socket *sock, int level, int optname,
>  	struct raw_sock *ro = raw_sk(sk);
>  	int len;
>  	void *val;
> -	int err = 0;
> 
>  	if (level != SOL_CAN_RAW)
>  		return -EINVAL;
> @@ -766,7 +765,9 @@ static int raw_getsockopt(struct socket *sock, int level, int optname,
>  		return -EINVAL;
> 
>  	switch (optname) {
> -	case CAN_RAW_FILTER:
> +	case CAN_RAW_FILTER: {
> +		int err = 0;
> +
>  		lock_sock(sk);
>  		if (ro->count > 0) {
>  			int fsize = ro->count * sizeof(struct can_filter);
> @@ -791,7 +792,7 @@ static int raw_getsockopt(struct socket *sock, int level, int optname,
>  		if (!err)
>  			err = put_user(len, optlen);
>  		return err;
> -
> +	}
>  	case CAN_RAW_ERR_FILTER:
>  		if (len > sizeof(can_err_mask_t))
>  			len = sizeof(can_err_mask_t);
> @@ -822,7 +823,9 @@ static int raw_getsockopt(struct socket *sock, int level, int optname,
>  		val = &ro->xl_frames;
>  		break;
> 
> -	case CAN_RAW_XL_VCID_OPTS:
> +	case CAN_RAW_XL_VCID_OPTS: {
> +		int err = 0;
> +
>  		/* user space buffer to small for VCID opts? */
>  		if (len < sizeof(ro->raw_vcid_opts)) {
>  			/* return -ERANGE and needed space in optlen */
> @@ -839,6 +842,7 @@ static int raw_getsockopt(struct socket *sock, int level, int optname,
>  			err = put_user(len, optlen);
>  		return err;
> 
> +	}
>  	case CAN_RAW_JOIN_FILTERS:
>  		if (len > sizeof(int))
>  			len = sizeof(int);

I'd be very tempted to change the code so that there is only one
put_user(len, optlen) right at the bottom.

If the code is obeying the normal 'rules' for getsockopt() the function
can actually return the length or an error and the caller can sort
out what to do with the data.
That makes the changes required to implement kernel_getsockopt()
a lot simpler.
I did start writing a patchset to do that, but some of the code
is entirely brain-dead.
But it would certainly make sense for the 'optlen' parameter to
be a kernel address and have been validated to be 'sane' (eg positive)
and have the syscall wrapper do the user copies.
It can't be done for the buffer (in all cases) because the user
supplied length isn't always the buffer length.
But the length field is defined to be an integer.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ