lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <f13c5bea08f87289446b48b3c0a095a5c25b20bf.camel@sipsolutions.net> Date: Mon, 24 Apr 2023 09:02:35 +0200 From: Johannes Berg <johannes@...solutions.net> To: Kuniyuki Iwashima <kuniyu@...zon.com>, "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com> Cc: Patrick McHardy <kaber@...sh.net>, Pablo Neira Ayuso <pablo@...filter.org>, Christophe Ricard <christophe-h.ricard@...com>, David Ahern <dsahern@...il.com>, Kuniyuki Iwashima <kuni1840@...il.com>, "netdev@...r.kernel.org" <netdev@...r.kernel.org>, Brad Spencer <bspencer@...ckberry.com> Subject: Re: [PATCH v3 net] netlink: Use copy_to_user() for optval in netlink_getsockopt(). On Fri, 2023-04-21 at 18:52 +0000, Kuniyuki Iwashima wrote: > Brad Spencer provided a detailed report [0] that when calling getsockopt() > for AF_NETLINK, some SOL_NETLINK options set only 1 byte even though such > options require at least sizeof(int) as length. > > The options return a flag value that fits into 1 byte, but such behaviour > confuses users who do not initialise the variable before calling > getsockopt() and do not strictly check the returned value as char. > > Currently, netlink_getsockopt() uses put_user() to copy data to optlen and > optval, but put_user() casts the data based on the pointer, char *optval. > As a result, only 1 byte is set to optval. > > To avoid this behaviour, we need to use copy_to_user() or cast optval for > put_user(). > > Note that this changes the behaviour on big-endian systems, but we document > that the size of optval is int in the man page. > > $ man 7 netlink > ... > Socket options > To set or get a netlink socket option, call getsockopt(2) to read > or setsockopt(2) to write the option with the option level argument > set to SOL_NETLINK. Unless otherwise noted, optval is a pointer to > an int. > > Fixes: 9a4595bc7e67 ("[NETLINK]: Add set/getsockopt options to support more than 32 groups") > Fixes: be0c22a46cfb ("netlink: add NETLINK_BROADCAST_ERROR socket option") > Fixes: 38938bfe3489 ("netlink: add NETLINK_NO_ENOBUFS socket flag") > Fixes: 0a6a3a23ea6e ("netlink: add NETLINK_CAP_ACK socket option") > Fixes: 2d4bc93368f5 ("netlink: extended ACK reporting") > Fixes: 89d35528d17d ("netlink: Add new socket option to enable strict checking on dumps") > Reported-by: Brad Spencer <bspencer@...ckberry.com> > Link: https://lore.kernel.org/netdev/ZD7VkNWFfp22kTDt@datsun.rim.net/ > Signed-off-by: Kuniyuki Iwashima <kuniyu@...zon.com> Reviewed-by: Johannes Berg <johannes@...solutions.net> Thanks! johannes
Powered by blists - more mailing lists