| Message ID | 20210928200647.GA266402@embeddedor (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net-next] netfilter: ebtables: use array_size() helper in copy_{from,to}_user() | expand |
| Context | Check | Description |
|---|---|---|
| netdev/cover_letter | success | Link |
| netdev/fixes_present | success | Link |
| netdev/patch_count | success | Link |
| netdev/tree_selection | success | Clearly marked for net-next |
| netdev/subject_prefix | success | Link |
| netdev/cc_maintainers | success | CCed 11 of 11 maintainers |
| netdev/source_inline | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Link |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/build_32bit | success | Errors and warnings before: 0 this patch: 0 |
| netdev/kdoc | success | Errors and warnings before: 0 this patch: 0 |
| netdev/verify_fixes | success | Link |
| netdev/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 25 lines checked |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 0 this patch: 0 |
| netdev/header_inline | success | Link |
On Tue, Sep 28, 2021 at 03:06:47PM -0500, Gustavo A. R. Silva wrote: > Use array_size() helper instead of the open-coded version in > copy_{from,to}_user(). These sorts of multiplication factors > need to be wrapped in array_size(). > > Link: https://github.com/KSPP/linux/issues/160 > Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Thanks! Reviewed-by: Kees Cook <keescook@chromium.org> I see that this is marked "Awaiting Upstream" (for an ebtables maintainer ack?) https://patchwork.kernel.org/project/netdevbpf/patch/20210928200647.GA266402@embeddedor/
On Thu, Oct 21, 2021 at 10:00:34AM -0700, Kees Cook wrote: > On Tue, Sep 28, 2021 at 03:06:47PM -0500, Gustavo A. R. Silva wrote: > > Use array_size() helper instead of the open-coded version in > > copy_{from,to}_user(). These sorts of multiplication factors > > need to be wrapped in array_size(). > > > > Link: https://github.com/KSPP/linux/issues/160 > > Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> > > Thanks! > > Reviewed-by: Kees Cook <keescook@chromium.org> > > I see that this is marked "Awaiting Upstream" (for an ebtables > maintainer ack?) > https://patchwork.kernel.org/project/netdevbpf/patch/20210928200647.GA266402@embeddedor/ I'll route this through the netfilter tree, thanks.
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c index 83d1798dfbb4..32fa05ec4a6d 100644 --- a/net/bridge/netfilter/ebtables.c +++ b/net/bridge/netfilter/ebtables.c @@ -1071,7 +1071,7 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl, */ if (repl->num_counters && copy_to_user(repl->counters, counterstmp, - repl->num_counters * sizeof(struct ebt_counter))) { + array_size(repl->num_counters, sizeof(struct ebt_counter)))) { /* Silent error, can't fail, new table is already in place */ net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n"); } @@ -1399,7 +1399,8 @@ static int do_update_counters(struct net *net, const char *name, goto unlock_mutex; } - if (copy_from_user(tmp, counters, num_counters * sizeof(*counters))) { + if (copy_from_user(tmp, counters, + array_size(num_counters, sizeof(*counters)))) { ret = -EFAULT; goto unlock_mutex; } @@ -1532,7 +1533,7 @@ static int copy_counters_to_user(struct ebt_table *t, write_unlock_bh(&t->lock); if (copy_to_user(user, counterstmp, - nentries * sizeof(struct ebt_counter))) + array_size(nentries, sizeof(struct ebt_counter)))) ret = -EFAULT; vfree(counterstmp); return ret;
Use array_size() helper instead of the open-coded version in copy_{from,to}_user(). These sorts of multiplication factors need to be wrapped in array_size(). Link: https://github.com/KSPP/linux/issues/160 Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> --- net/bridge/netfilter/ebtables.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)