* [PATCH] net: check passed optlen before reading
@ 2021-12-28 20:18 Tamir Duberstein
2021-12-28 21:02 ` Tamir Duberstein
0 siblings, 1 reply; 8+ messages in thread
From: Tamir Duberstein @ 2021-12-28 20:18 UTC (permalink / raw)
To: netdev
Cc: David S. Miller, Hideaki YOSHIFUJI, David Ahern, Jakub Kicinski,
linux-kernel, Tamir Duberstein
From 52e464972f88ff5e9647d92b63c815e1f350f65e Mon Sep 17 00:00:00 2001
From: Tamir Duberstein <tamird@gmail.com>
Date: Tue, 28 Dec 2021 15:09:11 -0500
Subject: [PATCH] net: check passed optlen before reading
Add a check that the user-provided option is at least as long as the
number of bytes we intend to read. Before this patch we would blindly
read sizeof(int) bytes even in cases where the user passed
optlen<sizeof(int), which would potentially read garbage or fault.
Discovered by new tests in https://github.com/google/gvisor/pull/6957.
Signed-off-by: Tamir Duberstein <tamird@gmail.com>
---
net/ipv6/raw.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 60f1e4f5be5a..547613058182 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1020,6 +1020,9 @@ static int do_rawv6_setsockopt(struct sock *sk,
int level, int optname,
struct raw6_sock *rp = raw6_sk(sk);
int val;
+ if (optlen < sizeof(val)) {
+ return -EINVAL;
+
if (copy_from_sockptr(&val, optval, sizeof(val)))
return -EFAULT;
--
2.34.1.448.ga2b2bfdf31-goog
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH] net: check passed optlen before reading
2021-12-28 20:18 [PATCH] net: check passed optlen before reading Tamir Duberstein
@ 2021-12-28 21:02 ` Tamir Duberstein
2021-12-28 23:54 ` Jakub Kicinski
0 siblings, 1 reply; 8+ messages in thread
From: Tamir Duberstein @ 2021-12-28 21:02 UTC (permalink / raw)
To: netdev
Cc: David S. Miller, Hideaki YOSHIFUJI, David Ahern, Jakub Kicinski,
linux-kernel
Errant brace in the earlier version.
From 8586be4d72c6c583b1085d2239076987e1b7c43a Mon Sep 17 00:00:00 2001
From: Tamir Duberstein <tamird@gmail.com>
Date: Tue, 28 Dec 2021 15:09:11 -0500
Subject: [PATCH v2] net: check passed optlen before reading
Add a check that the user-provided option is at least as long as the
number of bytes we intend to read. Before this patch we would blindly
read sizeof(int) bytes even in cases where the user passed
optlen<sizeof(int), which would potentially read garbage or fault.
Discovered by new tests in https://github.com/google/gvisor/pull/6957 .
Signed-off-by: Tamir Duberstein <tamird@gmail.com>
---
net/ipv6/raw.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 60f1e4f5be5a..c51d5ce3711c 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1020,6 +1020,9 @@ static int do_rawv6_setsockopt(struct sock *sk,
int level, int optname,
struct raw6_sock *rp = raw6_sk(sk);
int val;
+ if (optlen < sizeof(val))
+ return -EINVAL;
+
if (copy_from_sockptr(&val, optval, sizeof(val)))
return -EFAULT;
--
2.34.1.448.ga2b2bfdf31-goog
On Tue, Dec 28, 2021 at 3:18 PM Tamir Duberstein <tamird@gmail.com> wrote:
>
> From 52e464972f88ff5e9647d92b63c815e1f350f65e Mon Sep 17 00:00:00 2001
> From: Tamir Duberstein <tamird@gmail.com>
> Date: Tue, 28 Dec 2021 15:09:11 -0500
> Subject: [PATCH] net: check passed optlen before reading
>
> Add a check that the user-provided option is at least as long as the
> number of bytes we intend to read. Before this patch we would blindly
> read sizeof(int) bytes even in cases where the user passed
> optlen<sizeof(int), which would potentially read garbage or fault.
>
> Discovered by new tests in https://github.com/google/gvisor/pull/6957.
>
> Signed-off-by: Tamir Duberstein <tamird@gmail.com>
> ---
> net/ipv6/raw.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
> index 60f1e4f5be5a..547613058182 100644
> --- a/net/ipv6/raw.c
> +++ b/net/ipv6/raw.c
> @@ -1020,6 +1020,9 @@ static int do_rawv6_setsockopt(struct sock *sk,
> int level, int optname,
> struct raw6_sock *rp = raw6_sk(sk);
> int val;
>
> + if (optlen < sizeof(val)) {
> + return -EINVAL;
> +
> if (copy_from_sockptr(&val, optval, sizeof(val)))
> return -EFAULT;
>
> --
> 2.34.1.448.ga2b2bfdf31-goog
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH] net: check passed optlen before reading
2021-12-28 21:02 ` Tamir Duberstein
@ 2021-12-28 23:54 ` Jakub Kicinski
2021-12-29 15:08 ` Willem de Bruijn
0 siblings, 1 reply; 8+ messages in thread
From: Jakub Kicinski @ 2021-12-28 23:54 UTC (permalink / raw)
To: Tamir Duberstein
Cc: netdev, David S. Miller, Hideaki YOSHIFUJI, David Ahern, linux-kernel
On Tue, 28 Dec 2021 16:02:29 -0500 Tamir Duberstein wrote:
> Errant brace in the earlier version.
>
> From 8586be4d72c6c583b1085d2239076987e1b7c43a Mon Sep 17 00:00:00 2001
> From: Tamir Duberstein <tamird@gmail.com>
> Date: Tue, 28 Dec 2021 15:09:11 -0500
> Subject: [PATCH v2] net: check passed optlen before reading
>
> Add a check that the user-provided option is at least as long as the
> number of bytes we intend to read. Before this patch we would blindly
> read sizeof(int) bytes even in cases where the user passed
> optlen<sizeof(int), which would potentially read garbage or fault.
>
> Discovered by new tests in https://github.com/google/gvisor/pull/6957 .
>
> Signed-off-by: Tamir Duberstein <tamird@gmail.com>
Your patches are corrupted by your email client.
Can you try sending the latest version with git send-email?
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] net: check passed optlen before reading
2021-12-28 23:54 ` Jakub Kicinski
@ 2021-12-29 15:08 ` Willem de Bruijn
2021-12-29 19:46 ` Tamir Duberstein
0 siblings, 1 reply; 8+ messages in thread
From: Willem de Bruijn @ 2021-12-29 15:08 UTC (permalink / raw)
To: Jakub Kicinski
Cc: Tamir Duberstein, netdev, David S. Miller, Hideaki YOSHIFUJI,
David Ahern, linux-kernel
On Tue, Dec 28, 2021 at 6:54 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Tue, 28 Dec 2021 16:02:29 -0500 Tamir Duberstein wrote:
> > Errant brace in the earlier version.
> >
> > From 8586be4d72c6c583b1085d2239076987e1b7c43a Mon Sep 17 00:00:00 2001
> > From: Tamir Duberstein <tamird@gmail.com>
> > Date: Tue, 28 Dec 2021 15:09:11 -0500
> > Subject: [PATCH v2] net: check passed optlen before reading
> >
> > Add a check that the user-provided option is at least as long as the
> > number of bytes we intend to read. Before this patch we would blindly
> > read sizeof(int) bytes even in cases where the user passed
> > optlen<sizeof(int), which would potentially read garbage or fault.
> >
> > Discovered by new tests in https://github.com/google/gvisor/pull/6957 .
> >
> > Signed-off-by: Tamir Duberstein <tamird@gmail.com>
>
> Your patches are corrupted by your email client.
>
> Can you try sending the latest version with git send-email?
Then perhaps also update the subject line to make it more clear where
this applies: "ipv6: raw: check passed optlen before reading".
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] net: check passed optlen before reading
2021-12-29 15:08 ` Willem de Bruijn
@ 2021-12-29 19:46 ` Tamir Duberstein
2021-12-29 19:53 ` Willem de Bruijn
0 siblings, 1 reply; 8+ messages in thread
From: Tamir Duberstein @ 2021-12-29 19:46 UTC (permalink / raw)
To: Willem de Bruijn
Cc: Jakub Kicinski, netdev, David S. Miller, Hideaki YOSHIFUJI,
David Ahern, linux-kernel
I'm having some trouble sending this using git send-email because of
the firewall I'm behind.
Please pull from
git://github.com/tamird/linux raw-check-optlen
to get these changes:
280c5742aab2 ipv6: raw: check passed optlen before reading
If this is not acceptable, I'll send the patch again when I'm outside
the firewall. Apologies.
On Wed, Dec 29, 2021 at 10:09 AM Willem de Bruijn
<willemdebruijn.kernel@gmail.com> wrote:
>
> On Tue, Dec 28, 2021 at 6:54 PM Jakub Kicinski <kuba@kernel.org> wrote:
> >
> > On Tue, 28 Dec 2021 16:02:29 -0500 Tamir Duberstein wrote:
> > > Errant brace in the earlier version.
> > >
> > > From 8586be4d72c6c583b1085d2239076987e1b7c43a Mon Sep 17 00:00:00 2001
> > > From: Tamir Duberstein <tamird@gmail.com>
> > > Date: Tue, 28 Dec 2021 15:09:11 -0500
> > > Subject: [PATCH v2] net: check passed optlen before reading
> > >
> > > Add a check that the user-provided option is at least as long as the
> > > number of bytes we intend to read. Before this patch we would blindly
> > > read sizeof(int) bytes even in cases where the user passed
> > > optlen<sizeof(int), which would potentially read garbage or fault.
> > >
> > > Discovered by new tests in https://github.com/google/gvisor/pull/6957 .
> > >
> > > Signed-off-by: Tamir Duberstein <tamird@gmail.com>
> >
> > Your patches are corrupted by your email client.
> >
> > Can you try sending the latest version with git send-email?
>
> Then perhaps also update the subject line to make it more clear where
> this applies: "ipv6: raw: check passed optlen before reading".
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] net: check passed optlen before reading
2021-12-29 19:46 ` Tamir Duberstein
@ 2021-12-29 19:53 ` Willem de Bruijn
2021-12-29 19:57 ` Jakub Kicinski
0 siblings, 1 reply; 8+ messages in thread
From: Willem de Bruijn @ 2021-12-29 19:53 UTC (permalink / raw)
To: Tamir Duberstein
Cc: Willem de Bruijn, Jakub Kicinski, netdev, David S. Miller,
Hideaki YOSHIFUJI, David Ahern, linux-kernel
On Wed, Dec 29, 2021 at 2:50 PM Tamir Duberstein <tamird@gmail.com> wrote:
>
> I'm having some trouble sending this using git send-email because of
> the firewall I'm behind.
>
> Please pull from
> git://github.com/tamird/linux raw-check-optlen
> to get these changes:
> 280c5742aab2 ipv6: raw: check passed optlen before reading
>
> If this is not acceptable, I'll send the patch again when I'm outside
> the firewall. Apologies.
I can send it on your behalf, Tamir.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] net: check passed optlen before reading
2021-12-29 19:53 ` Willem de Bruijn
@ 2021-12-29 19:57 ` Jakub Kicinski
2021-12-29 20:12 ` Willem de Bruijn
0 siblings, 1 reply; 8+ messages in thread
From: Jakub Kicinski @ 2021-12-29 19:57 UTC (permalink / raw)
To: Willem de Bruijn
Cc: Tamir Duberstein, netdev, David S. Miller, Hideaki YOSHIFUJI,
David Ahern, linux-kernel
On Wed, 29 Dec 2021 14:53:10 -0500 Willem de Bruijn wrote:
> On Wed, Dec 29, 2021 at 2:50 PM Tamir Duberstein <tamird@gmail.com> wrote:
> >
> > I'm having some trouble sending this using git send-email because of
> > the firewall I'm behind.
> >
> > Please pull from
> > git://github.com/tamird/linux raw-check-optlen
> > to get these changes:
> > 280c5742aab2 ipv6: raw: check passed optlen before reading
> >
> > If this is not acceptable, I'll send the patch again when I'm outside
> > the firewall. Apologies.
>
> I can send it on your behalf, Tamir.
Or we can use this opportunity to try out the infra Konstantin had been
working on:
https://lore.kernel.org/all/20211217183942.npvkb3ajnx6p5cbp@meerkat.local/
b4 submit --send seems to support sending via some web thing?
Dunno if anyone tried it, yet.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] net: check passed optlen before reading
2021-12-29 19:57 ` Jakub Kicinski
@ 2021-12-29 20:12 ` Willem de Bruijn
0 siblings, 0 replies; 8+ messages in thread
From: Willem de Bruijn @ 2021-12-29 20:12 UTC (permalink / raw)
To: Jakub Kicinski
Cc: Willem de Bruijn, Tamir Duberstein, netdev, David S. Miller,
Hideaki YOSHIFUJI, David Ahern, linux-kernel
On Wed, Dec 29, 2021 at 2:58 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Wed, 29 Dec 2021 14:53:10 -0500 Willem de Bruijn wrote:
> > On Wed, Dec 29, 2021 at 2:50 PM Tamir Duberstein <tamird@gmail.com> wrote:
> > >
> > > I'm having some trouble sending this using git send-email because of
> > > the firewall I'm behind.
> > >
> > > Please pull from
> > > git://github.com/tamird/linux raw-check-optlen
> > > to get these changes:
> > > 280c5742aab2 ipv6: raw: check passed optlen before reading
> > >
> > > If this is not acceptable, I'll send the patch again when I'm outside
> > > the firewall. Apologies.
> >
> > I can send it on your behalf, Tamir.
>
> Or we can use this opportunity to try out the infra Konstantin had been
> working on:
>
> https://lore.kernel.org/all/20211217183942.npvkb3ajnx6p5cbp@meerkat.local/
>
> b4 submit --send seems to support sending via some web thing?
>
> Dunno if anyone tried it, yet.
I haven't tried b4 at all. Just sent it the traditional way for now.
Will take a look and maybe give it a spin next time.
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2021-12-29 20:13 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-12-28 20:18 [PATCH] net: check passed optlen before reading Tamir Duberstein
2021-12-28 21:02 ` Tamir Duberstein
2021-12-28 23:54 ` Jakub Kicinski
2021-12-29 15:08 ` Willem de Bruijn
2021-12-29 19:46 ` Tamir Duberstein
2021-12-29 19:53 ` Willem de Bruijn
2021-12-29 19:57 ` Jakub Kicinski
2021-12-29 20:12 ` Willem de Bruijn
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).