Messages in this thread Patch in this message | | | From | Tamir Duberstein <> | Date | Tue, 28 Dec 2021 15:18:32 -0500 | Subject | [PATCH] net: check passed optlen before reading |
| |
From 52e464972f88ff5e9647d92b63c815e1f350f65e Mon Sep 17 00:00:00 2001 From: Tamir Duberstein <tamird@gmail.com> Date: Tue, 28 Dec 2021 15:09:11 -0500 Subject: [PATCH] net: check passed optlen before reading
Add a check that the user-provided option is at least as long as the number of bytes we intend to read. Before this patch we would blindly read sizeof(int) bytes even in cases where the user passed optlen<sizeof(int), which would potentially read garbage or fault.
Discovered by new tests in https://github.com/google/gvisor/pull/6957.
Signed-off-by: Tamir Duberstein <tamird@gmail.com> --- net/ipv6/raw.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c index 60f1e4f5be5a..547613058182 100644 --- a/net/ipv6/raw.c +++ b/net/ipv6/raw.c @@ -1020,6 +1020,9 @@ static int do_rawv6_setsockopt(struct sock *sk, int level, int optname, struct raw6_sock *rp = raw6_sk(sk); int val;
+ if (optlen < sizeof(val)) { + return -EINVAL; + if (copy_from_sockptr(&val, optval, sizeof(val))) return -EFAULT;
-- 2.34.1.448.ga2b2bfdf31-goog
| |