* [PATCH] netrom: fix copying in user data in nr_setsockopt
@ 2022-01-04 9:21 Christoph Hellwig
2022-01-04 12:40 ` patchwork-bot+netdevbpf
2022-01-06 14:52 ` Dan Carpenter
0 siblings, 2 replies; 3+ messages in thread
From: Christoph Hellwig @ 2022-01-04 9:21 UTC (permalink / raw)
To: ralf, davem, kuba; +Cc: linux-hams, netdev, Dan Carpenter
This code used to copy in an unsigned long worth of data before
the sockptr_t conversion, so restore that.
Fixes: a7b75c5a8c41 ("net: pass a sockptr_t into ->setsockopt")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
---
net/netrom/af_netrom.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 775064cdd0ee4..f1ba7dd3d253d 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -306,7 +306,7 @@ static int nr_setsockopt(struct socket *sock, int level, int optname,
if (optlen < sizeof(unsigned int))
return -EINVAL;
- if (copy_from_sockptr(&opt, optval, sizeof(unsigned int)))
+ if (copy_from_sockptr(&opt, optval, sizeof(unsigned long)))
return -EFAULT;
switch (optname) {
--
2.30.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] netrom: fix copying in user data in nr_setsockopt
2022-01-04 9:21 [PATCH] netrom: fix copying in user data in nr_setsockopt Christoph Hellwig
@ 2022-01-04 12:40 ` patchwork-bot+netdevbpf
2022-01-06 14:52 ` Dan Carpenter
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-01-04 12:40 UTC (permalink / raw)
To: Christoph Hellwig; +Cc: ralf, davem, kuba, linux-hams, netdev, dan.carpenter
Hello:
This patch was applied to netdev/net.git (master)
by David S. Miller <davem@davemloft.net>:
On Tue, 4 Jan 2022 10:21:26 +0100 you wrote:
> This code used to copy in an unsigned long worth of data before
> the sockptr_t conversion, so restore that.
>
> Fixes: a7b75c5a8c41 ("net: pass a sockptr_t into ->setsockopt")
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Christoph Hellwig <hch@lst.de>
>
> [...]
Here is the summary with links:
- netrom: fix copying in user data in nr_setsockopt
https://git.kernel.org/netdev/net/c/3087a6f36ee0
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] netrom: fix copying in user data in nr_setsockopt
2022-01-04 9:21 [PATCH] netrom: fix copying in user data in nr_setsockopt Christoph Hellwig
2022-01-04 12:40 ` patchwork-bot+netdevbpf
@ 2022-01-06 14:52 ` Dan Carpenter
1 sibling, 0 replies; 3+ messages in thread
From: Dan Carpenter @ 2022-01-06 14:52 UTC (permalink / raw)
To: Christoph Hellwig, ralf; +Cc: davem, kuba, linux-hams, netdev
On Tue, Jan 04, 2022 at 10:21:26AM +0100, Christoph Hellwig wrote:
> This code used to copy in an unsigned long worth of data before
> the sockptr_t conversion, so restore that.
>
> Fixes: a7b75c5a8c41 ("net: pass a sockptr_t into ->setsockopt")
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Christoph Hellwig <hch@lst.de>
> ---
> net/netrom/af_netrom.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
> index 775064cdd0ee4..f1ba7dd3d253d 100644
> --- a/net/netrom/af_netrom.c
> +++ b/net/netrom/af_netrom.c
> @@ -306,7 +306,7 @@ static int nr_setsockopt(struct socket *sock, int level, int optname,
> if (optlen < sizeof(unsigned int))
> return -EINVAL;
>
> - if (copy_from_sockptr(&opt, optval, sizeof(unsigned int)))
> + if (copy_from_sockptr(&opt, optval, sizeof(unsigned long)))
> return -EFAULT;
No this isn't right. In the original code, it copied an unsigned int.
if (get_user(opt, (unsigned int __user *)optval))
The fix is to probably to change "opt" to an unsigned int. I wonder if
I need to update all the integer overflow checks to from:
- if (opt > ULONG_MAX / HZ)
+ if (opt > UINT_MAX / HZ)
...
Probably no one cares, right? Ralf?
regards,
dan carpenter
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-01-06 14:52 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-04 9:21 [PATCH] netrom: fix copying in user data in nr_setsockopt Christoph Hellwig
2022-01-04 12:40 ` patchwork-bot+netdevbpf
2022-01-06 14:52 ` Dan Carpenter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.