From: Christoph Hellwig <hch@lst.de>
To: "David S. Miller" <davem@davemloft.net>
Cc: Jan Engelhardt <jengelh@inai.de>,
Ido Schimmel <idosch@idosch.org>,
"Jason A. Donenfeld" <Jason@zx2c4.com>,
David Laight <David.Laight@ACULAB.COM>,
netdev@vger.kernel.org
Subject: [PATCH 4/4] net: improve the user pointer check in init_user_sockptr
Date: Tue, 28 Jul 2020 18:38:36 +0200 [thread overview]
Message-ID: <20200728163836.562074-5-hch@lst.de> (raw)
In-Reply-To: <20200728163836.562074-1-hch@lst.de>
Make sure not just the pointer itself but the whole range lies in
the user address space. For that pass the length and then use
the access_ok helper to do the check.
Fixes: 6d04fe15f78a ("net: optimize the sockptr_t for unified kernel/user address spaces")
Reported-by: David Laight <David.Laight@ACULAB.COM>
Signed-off-by: Christoph Hellwig <hch@lst.de>
---
include/linux/sockptr.h | 18 ++++++------------
net/ipv4/bpfilter/sockopt.c | 2 +-
net/socket.c | 2 +-
3 files changed, 8 insertions(+), 14 deletions(-)
diff --git a/include/linux/sockptr.h b/include/linux/sockptr.h
index 9e6c81d474cba8..96840def9d69cc 100644
--- a/include/linux/sockptr.h
+++ b/include/linux/sockptr.h
@@ -27,14 +27,6 @@ static inline sockptr_t KERNEL_SOCKPTR(void *p)
{
return (sockptr_t) { .kernel = p };
}
-
-static inline int __must_check init_user_sockptr(sockptr_t *sp, void __user *p)
-{
- if ((unsigned long)p >= TASK_SIZE)
- return -EFAULT;
- sp->user = p;
- return 0;
-}
#else /* CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE */
typedef struct {
union {
@@ -53,14 +45,16 @@ static inline sockptr_t KERNEL_SOCKPTR(void *p)
{
return (sockptr_t) { .kernel = p, .is_kernel = true };
}
+#endif /* CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE */
-static inline int __must_check init_user_sockptr(sockptr_t *sp, void __user *p)
+static inline int __must_check init_user_sockptr(sockptr_t *sp, void __user *p,
+ size_t size)
{
- sp->user = p;
- sp->is_kernel = false;
+ if (!access_ok(p, size))
+ return -EFAULT;
+ *sp = (sockptr_t) { .user = p };
return 0;
}
-#endif /* CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE */
static inline bool sockptr_is_null(sockptr_t sockptr)
{
diff --git a/net/ipv4/bpfilter/sockopt.c b/net/ipv4/bpfilter/sockopt.c
index 94f18d2352d007..545b2640f0194d 100644
--- a/net/ipv4/bpfilter/sockopt.c
+++ b/net/ipv4/bpfilter/sockopt.c
@@ -65,7 +65,7 @@ int bpfilter_ip_get_sockopt(struct sock *sk, int optname,
if (get_user(len, optlen))
return -EFAULT;
- err = init_user_sockptr(&optval, user_optval);
+ err = init_user_sockptr(&optval, user_optval, len);
if (err)
return err;
return bpfilter_mbox_request(sk, optname, optval, len, false);
diff --git a/net/socket.c b/net/socket.c
index 94ca4547cd7c53..aff52e81653ce3 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2105,7 +2105,7 @@ int __sys_setsockopt(int fd, int level, int optname, char __user *user_optval,
if (optlen < 0)
return -EINVAL;
- err = init_user_sockptr(&optval, user_optval);
+ err = init_user_sockptr(&optval, user_optval, optlen);
if (err)
return err;
--
2.27.0
next prev parent reply other threads:[~2020-07-28 16:38 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-28 16:38 [PATCH 0/4 net-next] sockptr_t fixes v2 Christoph Hellwig
2020-07-28 16:38 ` [PATCH 1/4] netfilter: arp_tables: restore a SPDX identifier Christoph Hellwig
2020-07-28 16:38 ` [PATCH 2/4] net: make sockptr_is_null strict aliasing safe Christoph Hellwig
2020-07-29 8:04 ` David Laight
2020-07-29 9:06 ` Jan Engelhardt
2020-07-28 16:38 ` [PATCH 3/4] net: remove sockptr_advance Christoph Hellwig
2020-07-28 16:38 ` Christoph Hellwig [this message]
2020-07-29 8:22 ` [PATCH 4/4] net: improve the user pointer check in init_user_sockptr David Laight
-- strict thread matches above, loose matches on Subject: below --
2020-07-28 6:36 [PATCH 0/4 net-next] sockptr_t fixes Christoph Hellwig
2020-07-28 6:36 ` [PATCH 4/4] net: improve the user pointer check in init_user_sockptr Christoph Hellwig
2020-07-28 15:47 ` Jakub Kicinski
2020-07-28 15:51 ` Christoph Hellwig
2020-07-28 18:53 ` Jakub Kicinski
2020-07-28 15:52 ` David Laight
2020-07-28 20:01 ` David Miller
2020-07-29 6:04 ` Christoph Hellwig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200728163836.562074-5-hch@lst.de \
--to=hch@lst.de \
--cc=David.Laight@ACULAB.COM \
--cc=Jason@zx2c4.com \
--cc=davem@davemloft.net \
--cc=idosch@idosch.org \
--cc=jengelh@inai.de \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).