diff mbox series

[5.10,41/43] ipv6: raw: check passed optlen before reading

Message ID	20220110071818.731814848@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Tamir Duberstein <tamird@gmail.com>, Willem de Bruijn <willemb@google.com>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 41/43] ipv6: raw: check passed optlen before reading Date: Mon, 10 Jan 2022 08:23:38 +0100 Message-Id: <20220110071818.731814848@linuxfoundation.org> In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,04/43] tracing: Tag trace_percpu_buffer as a percpu pointer [5.10,06/43] i40e: Fix to not show opcode msg on unsuccessful VF MAC change [5.10,09/43] netrom: fix copying in user data in nr_setsockopt [5.10,10/43] RDMA/uverbs: Check for null return of kmalloc_array [5.10,11/43] mac80211: initialize variable have_higher_than_11mbit [5.10,14/43] i40e: Fix for displaying message regarding NVM version [5.10,16/43] ftrace/samples: Add missing prototypes direct functions [5.10,17/43] ipv4: Check attribute length for RTA_GATEWAY in multipath route [5.10,20/43] ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route [5.10,21/43] lwtunnel: Validate RTA_ENCAP_TYPE attribute length [5.10,23/43] sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc [5.10,24/43] net: ena: Fix undefined state when tx request id is out of bounds [5.10,26/43] xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate [5.10,30/43] phonet: refcount leak in pep_sock_accep [5.10,31/43] power: bq25890: Enable continuous conversion for ADC at charging [5.10,32/43] ipv6: Continue processing multipath route even if gateway attribute is invalid [5.10,33/43] ipv6: Do cleanup if attribute validation fails in multipath route [5.10,35/43] scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() [5.10,37/43] net: udp: fix alignment problem in udp4_seq_show() [5.10,39/43] mISDN: change function names to avoid conflicts [5.10,41/43] ipv6: raw: check passed optlen before reading [5.10,43/43] Input: zinitix - make sure the IRQ is allocated before it gets enabled

Commit Message

Greg KH Jan. 10, 2022, 7:23 a.m. UTC

From: Tamir Duberstein <tamird@gmail.com>

[ Upstream commit fb7bc9204095090731430c8921f9e629740c110a ]

Add a check that the user-provided option is at least as long as the
number of bytes we intend to read. Before this patch we would blindly
read sizeof(int) bytes even in cases where the user passed
optlen<sizeof(int), which would potentially read garbage or fault.

Discovered by new tests in https://github.com/google/gvisor/pull/6957 .

The original get_user call predates history in the git repo.

Signed-off-by: Tamir Duberstein <tamird@gmail.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/r/20211229200947.2862255-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/raw.c | 3 +++
 1 file changed, 3 insertions(+)

diff mbox series

Patch

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 00f133a55ef7c..38349054e361e 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1020,6 +1020,9 @@  static int do_rawv6_setsockopt(struct sock *sk, int level, int optname,
 	struct raw6_sock *rp = raw6_sk(sk);
 	int val;
 
+	if (optlen < sizeof(val))
+		return -EINVAL;
+
 	if (copy_from_sockptr(&val, optval, sizeof(val)))
 		return -EFAULT;