lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <030b67dad5a96685f984082fd8fda08dfe0be985.camel@sipsolutions.net> Date: Mon, 24 Apr 2023 08:59:53 +0200 From: Johannes Berg <johannes@...solutions.net> To: David Ahern <dsahern@...il.com>, Kuniyuki Iwashima <kuniyu@...zon.com>, "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com> Cc: Patrick McHardy <kaber@...sh.net>, Pablo Neira Ayuso <pablo@...filter.org>, Christophe Ricard <christophe-h.ricard@...com>, Kuniyuki Iwashima <kuni1840@...il.com>, "netdev@...r.kernel.org" <netdev@...r.kernel.org>, Brad Spencer <bspencer@...ckberry.com> Subject: Re: [PATCH v3 net] netlink: Use copy_to_user() for optval in netlink_getsockopt(). On Sat, 2023-04-22 at 15:57 +0000, David Ahern wrote: > On 4/21/23 12:52 PM, Kuniyuki Iwashima wrote: > > diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c > > index f365dfdd672d..9b6eb28e6e94 100644 > > --- a/net/netlink/af_netlink.c > > +++ b/net/netlink/af_netlink.c > > @@ -1742,7 +1742,8 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname, > > { > > struct sock *sk = sock->sk; > > struct netlink_sock *nlk = nlk_sk(sk); > > - int len, val, err; > > + unsigned int flag; > > + int len, val; > > len is not initialized here ... > > > > > if (level != SOL_NETLINK) > > return -ENOPROTOOPT; > > @@ -1754,39 +1755,17 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname, > > > > switch (optname) { It's initialized in the context here: if (get_user(len, optlen)) return -EFAULT; if (len < 0) return -EINVAL; > > default: > > - err = -ENOPROTOOPT; > > + return -ENOPROTOOPT; > > } > > - return err; > > + > > + if (len < sizeof(int)) > > and then check len here. so that's OK. Note how the checks that were there before also were before the len assignments :) > > + return -EINVAL; > > seems like this chunk (len < sizeof(int)) is not needed. It is, if we get here we need at least the int size for the flags. johannes
Powered by blists - more mailing lists