[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20231102200943.GK1957730@ZenIV>
Date: Thu, 2 Nov 2023 20:09:43 +0000
From: Al Viro <viro@...iv.linux.org.uk>
To: Philipp Stanner <pstanner@...hat.com>
Cc: "David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
Stanislav Fomichev <sdf@...gle.com>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
Benjamin Tissoires <benjamin.tissoires@...hat.com>,
linux-ppp@...r.kernel.org, netdev@...r.kernel.org,
linux-kernel@...r.kernel.org, Dave Airlie <airlied@...hat.com>
Subject: Re: [PATCH] drivers/net/ppp: copy userspace array safely
On Thu, Nov 02, 2023 at 08:19:15PM +0100, Philipp Stanner wrote:
> In ppp_generic.c memdup_user() is utilized to copy a userspace array.
> This is done without an overflow check.
>
> Use the new wrapper memdup_array_user() to copy the array more safely.
> fprog.len = uprog->len;
> - fprog.filter = memdup_user(uprog->filter,
> - uprog->len * sizeof(struct sock_filter));
> + fprog.filter = memdup_array_user(uprog->filter,
> + uprog->len, sizeof(struct sock_filter));
Far be it from me to discourage security theat^Whardening, but
struct sock_fprog { /* Required for SO_ATTACH_FILTER. */
unsigned short len; /* Number of filter blocks */
struct sock_filter __user *filter;
};
struct sock_filter { /* Filter block */
__u16 code; /* Actual filter code */
__u8 jt; /* Jump true */
__u8 jf; /* Jump false */
__u32 k; /* Generic multiuse field */
};
so you might want to mention that overflow in question would have to be
in multiplying an untrusted 16bit value by 8...
Powered by blists - more mailing lists