linux-kernel - Re: [PATCH net-next v2 1/6] tcp: fix incorrect parameter validation in the do_tcp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAL+tcoC+ysfwDSJfuavL_8-3+nUbEAkruy3iuiHU7LizesicRw@mail.gmail.com>
Date: Fri, 8 Mar 2024 11:43:54 +0800
From: Jason Xing <kerneljasonxing@...il.com>
To: Gavrilov Ilia <Ilia.Gavrilov@...otecs.ru>
Cc: Eric Dumazet <edumazet@...gle.com>, "David S. Miller" <davem@...emloft.net>, 
	David Ahern <dsahern@...nel.org>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, 
	Simon Horman <horms@...nel.org>, "netdev@...r.kernel.org" <netdev@...r.kernel.org>, 
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, 
	"lvc-project@...uxtesting.org" <lvc-project@...uxtesting.org>
Subject: Re: [PATCH net-next v2 1/6] tcp: fix incorrect parameter validation
 in the do_tcp_getsockopt() function

On Thu, Mar 7, 2024 at 10:44 PM Gavrilov Ilia <Ilia.Gavrilov@...otecs.ru> wrote:
>
> The 'len' variable can't be negative when assigned the result of
> 'min_t' because all 'min_t' parameters are cast to unsigned int,
> and then the minimum one is chosen.
>
> To fix the logic, check 'len' as read from 'optlen',
> where the types of relevant variables are (signed) int.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@...otecs.ru>

For the patch itself, please feel free to add:
Reviewed-by: Jason Xing <kerneljasonxing@...il.com>

I notice that you use Fixes meanwhile you target net-next. I'm not
sure if it's proper.

> ---
> V2:
>  - reword the patch description
>
>  net/ipv4/tcp.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> index c82dc42f57c6..a4f418592314 100644
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ -4010,11 +4010,11 @@ int do_tcp_getsockopt(struct sock *sk, int level,
>         if (copy_from_sockptr(&len, optlen, sizeof(int)))
>                 return -EFAULT;
>
> -       len = min_t(unsigned int, len, sizeof(int));
> -
>         if (len < 0)
>                 return -EINVAL;
>
> +       len = min_t(unsigned int, len, sizeof(int));
> +
>         switch (optname) {
>         case TCP_MAXSEG:
>                 val = tp->mss_cache;
> --
> 2.39.2
>