netdev - RE: [PATCH] can: raw: raw_getsockopt(): reduce scope of err

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <7bb0474bad834a7c9f810c70e959ef12@AcuMS.aculab.com>
Date: Wed, 21 Feb 2024 22:44:32 +0000
From: David Laight <David.Laight@...LAB.COM>
To: 'Marc Kleine-Budde' <mkl@...gutronix.de>, Oliver Hartkopp
	<socketcan@...tkopp.net>, "David S. Miller" <davem@...emloft.net>, "Eric
 Dumazet" <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni
	<pabeni@...hat.com>
CC: "linux-can@...r.kernel.org" <linux-can@...r.kernel.org>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH] can: raw: raw_getsockopt(): reduce scope of err

From: Marc Kleine-Budde
> Sent: 20 February 2024 08:16
> 
> Reduce the scope of the variable "err" to the individual cases. This
> is to avoid the mistake of setting "err" in the mistaken belief that
> it will be evaluated later.
> 
> Signed-off-by: Marc Kleine-Budde <mkl@...gutronix.de>
> ---
>  net/can/raw.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
> 
> diff --git a/net/can/raw.c b/net/can/raw.c
> index 897ffc17d850..2bb3eab98af0 100644
> --- a/net/can/raw.c
> +++ b/net/can/raw.c
> @@ -756,7 +756,6 @@ static int raw_getsockopt(struct socket *sock, int level, int optname,
>  	struct raw_sock *ro = raw_sk(sk);
>  	int len;
>  	void *val;
> -	int err = 0;
> 
>  	if (level != SOL_CAN_RAW)
>  		return -EINVAL;
> @@ -766,7 +765,9 @@ static int raw_getsockopt(struct socket *sock, int level, int optname,
>  		return -EINVAL;
> 
>  	switch (optname) {
> -	case CAN_RAW_FILTER:
> +	case CAN_RAW_FILTER: {
> +		int err = 0;
> +
>  		lock_sock(sk);
>  		if (ro->count > 0) {
>  			int fsize = ro->count * sizeof(struct can_filter);
> @@ -791,7 +792,7 @@ static int raw_getsockopt(struct socket *sock, int level, int optname,
>  		if (!err)
>  			err = put_user(len, optlen);
>  		return err;
> -
> +	}
>  	case CAN_RAW_ERR_FILTER:
>  		if (len > sizeof(can_err_mask_t))
>  			len = sizeof(can_err_mask_t);
> @@ -822,7 +823,9 @@ static int raw_getsockopt(struct socket *sock, int level, int optname,
>  		val = &ro->xl_frames;
>  		break;
> 
> -	case CAN_RAW_XL_VCID_OPTS:
> +	case CAN_RAW_XL_VCID_OPTS: {
> +		int err = 0;
> +
>  		/* user space buffer to small for VCID opts? */
>  		if (len < sizeof(ro->raw_vcid_opts)) {
>  			/* return -ERANGE and needed space in optlen */
> @@ -839,6 +842,7 @@ static int raw_getsockopt(struct socket *sock, int level, int optname,
>  			err = put_user(len, optlen);
>  		return err;
> 
> +	}
>  	case CAN_RAW_JOIN_FILTERS:
>  		if (len > sizeof(int))
>  			len = sizeof(int);

I'd be very tempted to change the code so that there is only one
put_user(len, optlen) right at the bottom.

If the code is obeying the normal 'rules' for getsockopt() the function
can actually return the length or an error and the caller can sort
out what to do with the data.
That makes the changes required to implement kernel_getsockopt()
a lot simpler.
I did start writing a patchset to do that, but some of the code
is entirely brain-dead.
But it would certainly make sense for the 'optlen' parameter to
be a kernel address and have been validated to be 'sane' (eg positive)
and have the syscall wrapper do the user copies.
It can't be done for the buffer (in all cases) because the user
supplied length isn't always the buffer length.
But the length field is defined to be an integer.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)