netdev - Re: [PATCH v3 net] netlink: Use copy_to_user() for optval in netlink

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <226bfa8b-afe1-179a-5763-376e80ebe038@gmail.com>
Date:   Sat, 22 Apr 2023 09:57:15 -0600
From:   David Ahern <dsahern@...il.com>
To:     Kuniyuki Iwashima <kuniyu@...zon.com>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>
Cc:     Patrick McHardy <kaber@...sh.net>,
        Pablo Neira Ayuso <pablo@...filter.org>,
        Christophe Ricard <christophe-h.ricard@...com>,
        Johannes Berg <johannes.berg@...el.com>,
        Kuniyuki Iwashima <kuni1840@...il.com>, netdev@...r.kernel.org,
        Brad Spencer <bspencer@...ckberry.com>
Subject: Re: [PATCH v3 net] netlink: Use copy_to_user() for optval in
 netlink_getsockopt().

On 4/21/23 12:52 PM, Kuniyuki Iwashima wrote:
> diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
> index f365dfdd672d..9b6eb28e6e94 100644
> --- a/net/netlink/af_netlink.c
> +++ b/net/netlink/af_netlink.c
> @@ -1742,7 +1742,8 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
>  {
>  	struct sock *sk = sock->sk;
>  	struct netlink_sock *nlk = nlk_sk(sk);
> -	int len, val, err;
> +	unsigned int flag;
> +	int len, val;

len is not initialized here ...

>  
>  	if (level != SOL_NETLINK)
>  		return -ENOPROTOOPT;
> @@ -1754,39 +1755,17 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
>  
>  	switch (optname) {
>  	case NETLINK_PKTINFO:
> -		if (len < sizeof(int))
> -			return -EINVAL;
> -		len = sizeof(int);

you remove all of these ...

> -		val = nlk->flags & NETLINK_F_RECV_PKTINFO ? 1 : 0;
> -		if (put_user(len, optlen) ||
> -		    put_user(val, optval))
> -			return -EFAULT;
> -		err = 0;
> +		flag = NETLINK_F_RECV_PKTINFO;
>  		break;
>  	case NETLINK_BROADCAST_ERROR:
> -		if (len < sizeof(int))
> -			return -EINVAL;
> -		len = sizeof(int);
> -		val = nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR ? 1 : 0;
> -		if (put_user(len, optlen) ||
> -		    put_user(val, optval))
> -			return -EFAULT;
> -		err = 0;
> +		flag = NETLINK_F_BROADCAST_SEND_ERROR;
>  		break;
>  	case NETLINK_NO_ENOBUFS:
> -		if (len < sizeof(int))
> -			return -EINVAL;
> -		len = sizeof(int);
> -		val = nlk->flags & NETLINK_F_RECV_NO_ENOBUFS ? 1 : 0;
> -		if (put_user(len, optlen) ||
> -		    put_user(val, optval))
> -			return -EFAULT;
> -		err = 0;
> +		flag = NETLINK_F_RECV_NO_ENOBUFS;
>  		break;
>  	case NETLINK_LIST_MEMBERSHIPS: {
> -		int pos, idx, shift;
> +		int pos, idx, shift, err = 0;
>  
> -		err = 0;
>  		netlink_lock_table();
>  		for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
>  			if (len - pos < sizeof(u32))
> @@ -1803,40 +1782,32 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
>  		if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen))
>  			err = -EFAULT;
>  		netlink_unlock_table();
> -		break;
> +		return err;
>  	}
>  	case NETLINK_CAP_ACK:
> -		if (len < sizeof(int))
> -			return -EINVAL;
> -		len = sizeof(int);
> -		val = nlk->flags & NETLINK_F_CAP_ACK ? 1 : 0;
> -		if (put_user(len, optlen) ||
> -		    put_user(val, optval))
> -			return -EFAULT;
> -		err = 0;
> +		flag = NETLINK_F_CAP_ACK;
>  		break;
>  	case NETLINK_EXT_ACK:
> -		if (len < sizeof(int))
> -			return -EINVAL;
> -		len = sizeof(int);
> -		val = nlk->flags & NETLINK_F_EXT_ACK ? 1 : 0;
> -		if (put_user(len, optlen) || put_user(val, optval))
> -			return -EFAULT;
> -		err = 0;
> +		flag = NETLINK_F_EXT_ACK;
>  		break;
>  	case NETLINK_GET_STRICT_CHK:
> -		if (len < sizeof(int))
> -			return -EINVAL;
> -		len = sizeof(int);
> -		val = nlk->flags & NETLINK_F_STRICT_CHK ? 1 : 0;
> -		if (put_user(len, optlen) || put_user(val, optval))
> -			return -EFAULT;
> -		err = 0;
> +		flag = NETLINK_F_STRICT_CHK;
>  		break;
>  	default:
> -		err = -ENOPROTOOPT;
> +		return -ENOPROTOOPT;
>  	}
> -	return err;
> +
> +	if (len < sizeof(int))

and then check len here.

> +		return -EINVAL;

seems like this chunk (len < sizeof(int)) is not needed.

> +
> +	len = sizeof(int);
> +	val = nlk->flags & flag ? 1 : 0;
> +
> +	if (put_user(len, optlen) ||
> +	    copy_to_user(optval, &val, len))
> +		return -EFAULT;
> +
> +	return 0;
>  }
>  
>  static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)