]> git.proxmox.com Git - mirror_ubuntu-impish-kernel.git/commit
ipv6: raw: check passed optlen before reading
authorTamir Duberstein <tamird@gmail.com>
Wed, 29 Dec 2021 20:09:47 +0000 (15:09 -0500)
committerKleber Sacilotto de Souza <kleber.souza@canonical.com>
Mon, 7 Mar 2022 17:39:04 +0000 (18:39 +0100)
commit87b98de1c06c332174f07eeb31b29b6321a17d73
tree007282bd091c7868a8a9a1b261315d2d04f15a6e
parentbadba334e082e2a8206e3718ba07cdac55a5efa6
ipv6: raw: check passed optlen before reading

BugLink: https://bugs.launchpad.net/bugs/1959627
[ Upstream commit fb7bc9204095090731430c8921f9e629740c110a ]

Add a check that the user-provided option is at least as long as the
number of bytes we intend to read. Before this patch we would blindly
read sizeof(int) bytes even in cases where the user passed
optlen<sizeof(int), which would potentially read garbage or fault.

Discovered by new tests in https://github.com/google/gvisor/pull/6957 .

The original get_user call predates history in the git repo.

Signed-off-by: Tamir Duberstein <tamird@gmail.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/r/20211229200947.2862255-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
net/ipv6/raw.c