netdev - Re: [PATCH v3 net] netlink: Use copy_to_user() for optval in netlink

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <030b67dad5a96685f984082fd8fda08dfe0be985.camel@sipsolutions.net>
Date:   Mon, 24 Apr 2023 08:59:53 +0200
From:   Johannes Berg <johannes@...solutions.net>
To:     David Ahern <dsahern@...il.com>,
        Kuniyuki Iwashima <kuniyu@...zon.com>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>
Cc:     Patrick McHardy <kaber@...sh.net>,
        Pablo Neira Ayuso <pablo@...filter.org>,
        Christophe Ricard <christophe-h.ricard@...com>,
        Kuniyuki Iwashima <kuni1840@...il.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        Brad Spencer <bspencer@...ckberry.com>
Subject: Re: [PATCH v3 net] netlink: Use copy_to_user() for optval in
 netlink_getsockopt().

On Sat, 2023-04-22 at 15:57 +0000, David Ahern wrote:
> On 4/21/23 12:52 PM, Kuniyuki Iwashima wrote:
> > diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
> > index f365dfdd672d..9b6eb28e6e94 100644
> > --- a/net/netlink/af_netlink.c
> > +++ b/net/netlink/af_netlink.c
> > @@ -1742,7 +1742,8 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
> >  {
> >       struct sock *sk = sock->sk;
> >       struct netlink_sock *nlk = nlk_sk(sk);
> > -     int len, val, err;
> > +     unsigned int flag;
> > +     int len, val;
> 
> len is not initialized here ...
> 
> > 
> >       if (level != SOL_NETLINK)
> >               return -ENOPROTOOPT;
> > @@ -1754,39 +1755,17 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
> > 
> >       switch (optname) {

It's initialized in the context here:

        if (get_user(len, optlen))
                return -EFAULT;
        if (len < 0)
                return -EINVAL;

> >       default:
> > -             err = -ENOPROTOOPT;
> > +             return -ENOPROTOOPT;
> >       }
> > -     return err;
> > +
> > +     if (len < sizeof(int))
> 
> and then check len here.

so that's OK. Note how the checks that were there before also were
before the len assignments :)

> > +             return -EINVAL;
> 
> seems like this chunk (len < sizeof(int)) is not needed.

It is, if we get here we need at least the int size for the flags.

johannes