netdev - Re: [PATCH net v3 0/4] net: Fix some callers of copy_from

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7f968fde-8a41-4152-8b39-72d5b21a19a2@redhat.com>
Date: Tue, 26 Nov 2024 10:00:19 +0100
From: Paolo Abeni <pabeni@...hat.com>
To: Michal Luczaj <mhal@...x.co>,
 Luiz Augusto von Dentz <luiz.dentz@...il.com>,
 David Howells <dhowells@...hat.com>
Cc: Luiz Augusto von Dentz <luiz.von.dentz@...el.com>,
 linux-bluetooth@...r.kernel.org, netdev@...r.kernel.org,
 linux-afs@...ts.infradead.org, Jakub Kicinski <kuba@...nel.org>,
 David Wei <dw@...idwei.uk>, Marcel Holtmann <marcel@...tmann.org>,
 Johan Hedberg <johan.hedberg@...il.com>,
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
 Simon Horman <horms@...nel.org>, Marc Dionne <marc.dionne@...istor.com>
Subject: Re: [PATCH net v3 0/4] net: Fix some callers of copy_from_sockptr()

On 11/19/24 14:31, Michal Luczaj wrote:
> Some callers misinterpret copy_from_sockptr()'s return value. The function
> follows copy_from_user(), i.e. returns 0 for success, or the number of
> bytes not copied on error. Simply returning the result in a non-zero case
> isn't usually what was intended.
> 
> Compile tested with CONFIG_LLC, CONFIG_AF_RXRPC, CONFIG_BT enabled.
> 
> Last patch probably belongs more to net-next, if any. Here as an RFC.
> 
> Suggested-by: Jakub Kicinski <kuba@...nel.org>
> Signed-off-by: Michal Luczaj <mhal@...x.co>
> ---
> Changes in v3:
> - rxrpc/llc: Drop the non-essential changes
> - rxrpc/llc: Replace the deprecated copy_from_sockptr() with
>   copy_safe_from_sockptr() [David Wei]
> - Collect Reviewed-by [David Wei]
> - Link to v2: https://lore.kernel.org/r/20241115-sockptr-copy-fixes-v2-0-9b1254c18b7a@rbox.co
> 
> Changes in v2:
> - Fix the fix of llc_ui_setsockopt()
> - Switch "bluetooth:" to "Bluetooth:" [bluez.test.bot]
> - Collect Reviewed-by [Luiz Augusto von Dentz]
> - Link to v1: https://lore.kernel.org/r/20241115-sockptr-copy-fixes-v1-0-d183c87fcbd5@rbox.co
> 
> ---
> Michal Luczaj (4):
>       Bluetooth: Improve setsockopt() handling of malformed user input
>       llc: Improve setsockopt() handling of malformed user input
>       rxrpc: Improve setsockopt() handling of malformed user input
>       net: Comment copy_from_sockptr() explaining its behaviour

I guess we can apply directly patch 2-4, but patch 1 should go via the
BT tree. @Luiz, @David, are you ok with that?

Thanks,

Paolo