summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorTamir Duberstein <tamird@gmail.com>2021-12-29 23:09:47 +0300
committerJakub Kicinski <kuba@kernel.org>2021-12-29 23:32:56 +0300
commitfb7bc9204095090731430c8921f9e629740c110a (patch)
tree99f8bb92eacdd49acda31dd0c5c8dc8f5827f4f3 /net
parent5bec7ca2be6955ca1aa0d7bae2b981de9b1c9844 (diff)
downloadlinux-fb7bc9204095090731430c8921f9e629740c110a.tar.xz
ipv6: raw: check passed optlen before reading
Add a check that the user-provided option is at least as long as the number of bytes we intend to read. Before this patch we would blindly read sizeof(int) bytes even in cases where the user passed optlen<sizeof(int), which would potentially read garbage or fault. Discovered by new tests in https://github.com/google/gvisor/pull/6957 . The original get_user call predates history in the git repo. Signed-off-by: Tamir Duberstein <tamird@gmail.com> Signed-off-by: Willem de Bruijn <willemb@google.com> Link: https://lore.kernel.org/r/20211229200947.2862255-1-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net')
-rw-r--r--net/ipv6/raw.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 60f1e4f5be5a..c51d5ce3711c 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1020,6 +1020,9 @@ static int do_rawv6_setsockopt(struct sock *sk, int level, int optname,
struct raw6_sock *rp = raw6_sk(sk);
int val;
+ if (optlen < sizeof(val))
+ return -EINVAL;
+
if (copy_from_sockptr(&val, optval, sizeof(val)))
return -EFAULT;