mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-27 12:57:53 +00:00
net: add copy_safe_from_sockptr() helper
[ Upstream commit 6309863b31
]
copy_from_sockptr() helper is unsafe, unless callers
did the prior check against user provided optlen.
Too many callers get this wrong, lets add a helper to
fix them and avoid future copy/paste bugs.
Instead of :
if (optlen < sizeof(opt)) {
err = -EINVAL;
break;
}
if (copy_from_sockptr(&opt, optval, sizeof(opt)) {
err = -EFAULT;
break;
}
Use :
err = copy_safe_from_sockptr(&opt, sizeof(opt),
optval, optlen);
if (err)
break;
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20240408082845.3957374-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
12b2e35e3f
commit
f84429bdf2
1 changed files with 25 additions and 0 deletions
|
@ -50,11 +50,36 @@ static inline int copy_from_sockptr_offset(void *dst, sockptr_t src,
|
|||
return 0;
|
||||
}
|
||||
|
||||
/* Deprecated.
|
||||
* This is unsafe, unless caller checked user provided optlen.
|
||||
* Prefer copy_safe_from_sockptr() instead.
|
||||
*/
|
||||
static inline int copy_from_sockptr(void *dst, sockptr_t src, size_t size)
|
||||
{
|
||||
return copy_from_sockptr_offset(dst, src, 0, size);
|
||||
}
|
||||
|
||||
/**
|
||||
* copy_safe_from_sockptr: copy a struct from sockptr
|
||||
* @dst: Destination address, in kernel space. This buffer must be @ksize
|
||||
* bytes long.
|
||||
* @ksize: Size of @dst struct.
|
||||
* @optval: Source address. (in user or kernel space)
|
||||
* @optlen: Size of @optval data.
|
||||
*
|
||||
* Returns:
|
||||
* * -EINVAL: @optlen < @ksize
|
||||
* * -EFAULT: access to userspace failed.
|
||||
* * 0 : @ksize bytes were copied
|
||||
*/
|
||||
static inline int copy_safe_from_sockptr(void *dst, size_t ksize,
|
||||
sockptr_t optval, unsigned int optlen)
|
||||
{
|
||||
if (optlen < ksize)
|
||||
return -EINVAL;
|
||||
return copy_from_sockptr(dst, optval, ksize);
|
||||
}
|
||||
|
||||
static inline int copy_struct_from_sockptr(void *dst, size_t ksize,
|
||||
sockptr_t src, size_t usize)
|
||||
{
|
||||
|
|
Loading…
Reference in a new issue