* [PATCH][net-next] netfilter: ebtables: use array_size() helper in copy_{from,to}_user()
@ 2021-09-28 20:06 Gustavo A. R. Silva
2021-10-21 17:00 ` Kees Cook
0 siblings, 1 reply; 3+ messages in thread
From: Gustavo A. R. Silva @ 2021-09-28 20:06 UTC (permalink / raw)
To: Pablo Neira Ayuso, Jozsef Kadlecsik, Florian Westphal,
Roopa Prabhu, Nikolay Aleksandrov, David S. Miller,
Jakub Kicinski
Cc: netfilter-devel, coreteam, bridge, netdev, linux-kernel,
Gustavo A. R. Silva, linux-hardening
Use array_size() helper instead of the open-coded version in
copy_{from,to}_user(). These sorts of multiplication factors
need to be wrapped in array_size().
Link: https://github.com/KSPP/linux/issues/160
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
net/bridge/netfilter/ebtables.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 83d1798dfbb4..32fa05ec4a6d 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1071,7 +1071,7 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl,
*/
if (repl->num_counters &&
copy_to_user(repl->counters, counterstmp,
- repl->num_counters * sizeof(struct ebt_counter))) {
+ array_size(repl->num_counters, sizeof(struct ebt_counter)))) {
/* Silent error, can't fail, new table is already in place */
net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n");
}
@@ -1399,7 +1399,8 @@ static int do_update_counters(struct net *net, const char *name,
goto unlock_mutex;
}
- if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) {
+ if (copy_from_user(tmp, counters,
+ array_size(num_counters, sizeof(*counters)))) {
ret = -EFAULT;
goto unlock_mutex;
}
@@ -1532,7 +1533,7 @@ static int copy_counters_to_user(struct ebt_table *t,
write_unlock_bh(&t->lock);
if (copy_to_user(user, counterstmp,
- nentries * sizeof(struct ebt_counter)))
+ array_size(nentries, sizeof(struct ebt_counter))))
ret = -EFAULT;
vfree(counterstmp);
return ret;
--
2.27.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH][net-next] netfilter: ebtables: use array_size() helper in copy_{from,to}_user()
2021-09-28 20:06 [PATCH][net-next] netfilter: ebtables: use array_size() helper in copy_{from,to}_user() Gustavo A. R. Silva
@ 2021-10-21 17:00 ` Kees Cook
2021-10-21 18:16 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Kees Cook @ 2021-10-21 17:00 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: Pablo Neira Ayuso, Jozsef Kadlecsik, Florian Westphal,
Roopa Prabhu, Nikolay Aleksandrov, David S. Miller,
Jakub Kicinski, netfilter-devel, coreteam, bridge, netdev,
linux-kernel, linux-hardening
On Tue, Sep 28, 2021 at 03:06:47PM -0500, Gustavo A. R. Silva wrote:
> Use array_size() helper instead of the open-coded version in
> copy_{from,to}_user(). These sorts of multiplication factors
> need to be wrapped in array_size().
>
> Link: https://github.com/KSPP/linux/issues/160
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Thanks!
Reviewed-by: Kees Cook <keescook@chromium.org>
I see that this is marked "Awaiting Upstream" (for an ebtables
maintainer ack?)
https://patchwork.kernel.org/project/netdevbpf/patch/20210928200647.GA266402@embeddedor/
--
Kees Cook
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH][net-next] netfilter: ebtables: use array_size() helper in copy_{from,to}_user()
2021-10-21 17:00 ` Kees Cook
@ 2021-10-21 18:16 ` Pablo Neira Ayuso
0 siblings, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2021-10-21 18:16 UTC (permalink / raw)
To: Kees Cook
Cc: Gustavo A. R. Silva, Jozsef Kadlecsik, Florian Westphal,
Roopa Prabhu, Nikolay Aleksandrov, David S. Miller,
Jakub Kicinski, netfilter-devel, coreteam, bridge, netdev,
linux-kernel, linux-hardening
On Thu, Oct 21, 2021 at 10:00:34AM -0700, Kees Cook wrote:
> On Tue, Sep 28, 2021 at 03:06:47PM -0500, Gustavo A. R. Silva wrote:
> > Use array_size() helper instead of the open-coded version in
> > copy_{from,to}_user(). These sorts of multiplication factors
> > need to be wrapped in array_size().
> >
> > Link: https://github.com/KSPP/linux/issues/160
> > Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
>
> Thanks!
>
> Reviewed-by: Kees Cook <keescook@chromium.org>
>
> I see that this is marked "Awaiting Upstream" (for an ebtables
> maintainer ack?)
> https://patchwork.kernel.org/project/netdevbpf/patch/20210928200647.GA266402@embeddedor/
I'll route this through the netfilter tree, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-10-21 18:16 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-28 20:06 [PATCH][net-next] netfilter: ebtables: use array_size() helper in copy_{from,to}_user() Gustavo A. R. Silva
2021-10-21 17:00 ` Kees Cook
2021-10-21 18:16 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).