netdev - Re: IPV6: make ipv6_getsockopt_sticky honor user's buffer size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 09 Mar 2007 09:49:32 +0900 (JST)
From:	YOSHIFUJI Hideaki / 吉藤英明 
	<yoshfuji@...ux-ipv6.org>
To:	davem@...emloft.net
Cc:	chrisw@...s-sol.org, netdev@...r.kernel.org,
	yoshfuji@...ux-ipv6.org
Subject: Re: IPV6: make ipv6_getsockopt_sticky honor user's buffer size

In article <20070308.143804.21927824.davem@...emloft.net> (at Thu, 08 Mar 2007 14:38:04 -0800 (PST)), David Miller <davem@...emloft.net> says:

> From: Chris Wright <chrisw@...s-sol.org>
> Date: Wed, 7 Mar 2007 23:10:48 -0800
> 
> > Make sure not to copy_to_user more than user's buffer can handle (we
> > already checked the min, just use it) in ipv6_getsockopt_sticky.  And
> > while there, minor whitespace cleanup now that ipv6_getsockopt_sticky
> > call can nicely fit on one line.
> > 
> > Signed-off-by: Chris Wright <chrisw@...s-sol.org>
> 
> I wonder about this :-)
> 
> This gives the user now way to figure out that ipv6_optlen(hdr) is
> larger than the len they supplied.
> 
> In other situations usually we validate the length and return -EINVAL
> if it is too small.
> 
> That might be the thing to do in this case too.

We should give truncated result and return full length
from the POSIX POV.

--yoshfuji
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html