All of lore.kernel.org
 help / color / mirror / Atom feed
From: Norbert Slusarek <nslusarek@gmx.net>
To: netdev@vger.kernel.org
Cc: ore@pengutronix.de, mkl@pengutronix.de, socketcan@hartkopp.net,
	davem@davemloft.net, kuba@kernel.org, linux-can@vger.kernel.org,
	nslusarek@gmx.net, kernel@pengutronix.de
Subject: [PATCH] can: j1939: prevent allocation of j1939 filter for optlen = 0
Date: Sun, 20 Jun 2021 14:38:42 +0200	[thread overview]
Message-ID: <20210620123842.117975-1-nslusarek@gmx.net> (raw)

If optval != NULL and optlen = 0 are specified for SO_J1939_FILTER in
j1939_sk_setsockopt(), memdup_sockptr() will return ZERO_PTR for 0 size
allocation. The new filter will be mistakenly assigned ZERO_PTR.
This patch checks for optlen != 0 and filter will be assigned NULL
in case of optlen = 0.

Fixes: a7b75c5a8c41 ("net: pass a sockptr_t into ->setsockopt")
Signed-off-by: Norbert Slusarek <nslusarek@gmx.net>

---
 net/can/j1939/socket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c
index 56aa66147d5a..ff20cb629200 100644
--- a/net/can/j1939/socket.c
+++ b/net/can/j1939/socket.c
@@ -673,7 +673,7 @@ static int j1939_sk_setsockopt(struct socket *sock, int level, int optname,

 	switch (optname) {
 	case SO_J1939_FILTER:
-		if (!sockptr_is_null(optval)) {
+		if (!sockptr_is_null(optval) && optlen != 0) {
 			struct j1939_filter *f;
 			int c;

--
2.30.2

             reply	other threads:[~2021-06-20 12:39 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-06-20 12:38 Norbert Slusarek [this message]
2021-06-21  4:47 ` [PATCH] can: j1939: prevent allocation of j1939 filter for optlen = 0 Oleksij Rempel
2021-06-21  7:47 ` Marc Kleine-Budde

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210620123842.117975-1-nslusarek@gmx.net \
    --to=nslusarek@gmx.net \
    --cc=davem@davemloft.net \
    --cc=kernel@pengutronix.de \
    --cc=kuba@kernel.org \
    --cc=linux-can@vger.kernel.org \
    --cc=mkl@pengutronix.de \
    --cc=netdev@vger.kernel.org \
    --cc=ore@pengutronix.de \
    --cc=socketcan@hartkopp.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.