summaryrefslogtreecommitdiff
path: root/security/security.c
diff options
context:
space:
mode:
authorJakub Kicinski <kuba@kernel.org>2024-02-23 02:24:56 +0300
committerJakub Kicinski <kuba@kernel.org>2024-02-23 02:29:26 +0300
commitfecc51559a844b7f74119159c3cdb25b80b4e2c6 (patch)
tree2cf1e49810eb0c58e552f722cc2ab2742e62cf43 /security/security.c
parent0fb848d1a41e0d3895cb157810862db6046063dd (diff)
parent6714ebb922ab15a209dfc3c1ed29d4bb0abc9f02 (diff)
downloadlinux-fecc51559a844b7f74119159c3cdb25b80b4e2c6.tar.xz
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Cross-merge networking fixes after downstream PR. Conflicts: net/ipv4/udp.c f796feabb9f5 ("udp: add local "peek offset enabled" flag") 56667da7399e ("net: implement lockless setsockopt(SO_PEEK_OFF)") Adjacent changes: net/unix/garbage.c aa82ac51d633 ("af_unix: Drop oob_skb ref before purging queue in GC.") 11498715f266 ("af_unix: Remove io_uring code for GC.") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'security/security.c')
-rw-r--r--security/security.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/security/security.c b/security/security.c
index c41ad69a7f19..aef69632d0a9 100644
--- a/security/security.c
+++ b/security/security.c
@@ -29,6 +29,7 @@
#include <linux/backing-dev.h>
#include <linux/string.h>
#include <linux/msg.h>
+#include <linux/overflow.h>
#include <net/flow.h>
/* How many LSMs were built into the kernel? */
@@ -4015,6 +4016,7 @@ int security_setselfattr(unsigned int attr, struct lsm_ctx __user *uctx,
struct security_hook_list *hp;
struct lsm_ctx *lctx;
int rc = LSM_RET_DEFAULT(setselfattr);
+ u64 required_len;
if (flags)
return -EINVAL;
@@ -4027,8 +4029,9 @@ int security_setselfattr(unsigned int attr, struct lsm_ctx __user *uctx,
if (IS_ERR(lctx))
return PTR_ERR(lctx);
- if (size < lctx->len || size < lctx->ctx_len + sizeof(*lctx) ||
- lctx->len < lctx->ctx_len + sizeof(*lctx)) {
+ if (size < lctx->len ||
+ check_add_overflow(sizeof(*lctx), lctx->ctx_len, &required_len) ||
+ lctx->len < required_len) {
rc = -EINVAL;
goto free_out;
}