[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20250317090401.1240704-1-ps.report@gmx.net>
Date: Mon, 17 Mar 2025 10:04:00 +0100
From: Peter Seiderer <ps.report@....net>
To: netdev@...r.kernel.org
Cc: linux-kernel@...r.kernel.org,
linux-kselftest@...r.kernel.org,
Dan Carpenter <dan.carpenter@...aro.org>,
"David S . Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>,
Paolo Abeni <pabeni@...hat.com>,
Simon Horman <horms@...nel.org>,
Shuah Khan <shuah@...nel.org>,
Peter Seiderer <ps.report@....net>
Subject: [PATCH net-next v1 1/2] net: pktgen: add strict buffer parsing index check
Add strict buffer parsing index check to avoid the following Smatch
warning:
net/core/pktgen.c:877 get_imix_entries()
warn: check that incremented offset 'i' is capped
Checking the buffer index i after every get_user/i++ step and returning
with error code immediately avoids the current indirect (but correct)
error handling.
Reported-by: Dan Carpenter <dan.carpenter@...aro.org>
Closes: https://lore.kernel.org/netdev/36cf3ee2-38b1-47e5-a42a-363efeb0ace3@stanley.mountain/
Signed-off-by: Peter Seiderer <ps.report@....net>
---
net/core/pktgen.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index e850598db3e7..fe7fdefab994 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -856,6 +856,9 @@ static ssize_t get_imix_entries(const char __user *buffer,
if (pkt_dev->n_imix_entries >= MAX_IMIX_ENTRIES)
return -E2BIG;
+ if (i >= maxlen)
+ return -EINVAL;
+
max = min(10, maxlen - i);
len = num_arg(&buffer[i], max, &size);
if (len < 0)
@@ -869,6 +872,8 @@ static ssize_t get_imix_entries(const char __user *buffer,
if (c != ',')
return -EINVAL;
i++;
+ if (i >= maxlen)
+ return -EINVAL;
if (size < 14 + 20 + 8)
size = 14 + 20 + 8;
@@ -911,6 +916,9 @@ static ssize_t get_labels(const char __user *buffer,
if (n >= MAX_MPLS_LABELS)
return -E2BIG;
+ if (i >= maxlen)
+ return -EINVAL;
+
max = min(8, maxlen - i);
len = hex32_arg(&buffer[i], max, &tmp);
if (len < 0)
--
2.48.1
Powered by blists - more mailing lists