| Message ID | 20220104092126.172508-1-hch@lst.de (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 3087a6f36ee028ec095c04a8531d7d33899b7fed |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | netrom: fix copying in user data in nr_setsockopt | expand |
Hello: This patch was applied to netdev/net.git (master) by David S. Miller <davem@davemloft.net>: On Tue, 4 Jan 2022 10:21:26 +0100 you wrote: > This code used to copy in an unsigned long worth of data before > the sockptr_t conversion, so restore that. > > Fixes: a7b75c5a8c41 ("net: pass a sockptr_t into ->setsockopt") > Reported-by: Dan Carpenter <dan.carpenter@oracle.com> > Signed-off-by: Christoph Hellwig <hch@lst.de> > > [...] Here is the summary with links: - netrom: fix copying in user data in nr_setsockopt https://git.kernel.org/netdev/net/c/3087a6f36ee0 You are awesome, thank you!
On Tue, Jan 04, 2022 at 10:21:26AM +0100, Christoph Hellwig wrote: > This code used to copy in an unsigned long worth of data before > the sockptr_t conversion, so restore that. > > Fixes: a7b75c5a8c41 ("net: pass a sockptr_t into ->setsockopt") > Reported-by: Dan Carpenter <dan.carpenter@oracle.com> > Signed-off-by: Christoph Hellwig <hch@lst.de> > --- > net/netrom/af_netrom.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c > index 775064cdd0ee4..f1ba7dd3d253d 100644 > --- a/net/netrom/af_netrom.c > +++ b/net/netrom/af_netrom.c > @@ -306,7 +306,7 @@ static int nr_setsockopt(struct socket *sock, int level, int optname, > if (optlen < sizeof(unsigned int)) > return -EINVAL; > > - if (copy_from_sockptr(&opt, optval, sizeof(unsigned int))) > + if (copy_from_sockptr(&opt, optval, sizeof(unsigned long))) > return -EFAULT; No this isn't right. In the original code, it copied an unsigned int. if (get_user(opt, (unsigned int __user *)optval)) The fix is to probably to change "opt" to an unsigned int. I wonder if I need to update all the integer overflow checks to from: - if (opt > ULONG_MAX / HZ) + if (opt > UINT_MAX / HZ) ... Probably no one cares, right? Ralf? regards, dan carpenter
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index 775064cdd0ee4..f1ba7dd3d253d 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -306,7 +306,7 @@ static int nr_setsockopt(struct socket *sock, int level, int optname, if (optlen < sizeof(unsigned int)) return -EINVAL; - if (copy_from_sockptr(&opt, optval, sizeof(unsigned int))) + if (copy_from_sockptr(&opt, optval, sizeof(unsigned long))) return -EFAULT; switch (optname) {
This code used to copy in an unsigned long worth of data before the sockptr_t conversion, so restore that. Fixes: a7b75c5a8c41 ("net: pass a sockptr_t into ->setsockopt") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Christoph Hellwig <hch@lst.de> --- net/netrom/af_netrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)