lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <20220103172849.1612731-15-sashal@kernel.org> Date: Mon, 3 Jan 2022 12:28:48 -0500 From: Sasha Levin <sashal@...nel.org> To: linux-kernel@...r.kernel.org, stable@...r.kernel.org Cc: Tamir Duberstein <tamird@...il.com>, Willem de Bruijn <willemb@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Sasha Levin <sashal@...nel.org>, davem@...emloft.net, yoshfuji@...ux-ipv6.org, dsahern@...nel.org, netdev@...r.kernel.org Subject: [PATCH AUTOSEL 5.15 15/16] ipv6: raw: check passed optlen before reading From: Tamir Duberstein <tamird@...il.com> [ Upstream commit fb7bc9204095090731430c8921f9e629740c110a ] Add a check that the user-provided option is at least as long as the number of bytes we intend to read. Before this patch we would blindly read sizeof(int) bytes even in cases where the user passed optlen<sizeof(int), which would potentially read garbage or fault. Discovered by new tests in https://github.com/google/gvisor/pull/6957 . The original get_user call predates history in the git repo. Signed-off-by: Tamir Duberstein <tamird@...il.com> Signed-off-by: Willem de Bruijn <willemb@...gle.com> Link: https://lore.kernel.org/r/20211229200947.2862255-1-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski <kuba@...nel.org> Signed-off-by: Sasha Levin <sashal@...nel.org> --- net/ipv6/raw.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c index 60f1e4f5be5aa..c51d5ce3711c2 100644 --- a/net/ipv6/raw.c +++ b/net/ipv6/raw.c @@ -1020,6 +1020,9 @@ static int do_rawv6_setsockopt(struct sock *sk, int level, int optname, struct raw6_sock *rp = raw6_sk(sk); int val; + if (optlen < sizeof(val)) + return -EINVAL; + if (copy_from_sockptr(&val, optval, sizeof(val))) return -EFAULT; -- 2.34.1
Powered by blists - more mailing lists