| Message ID | 20240306095436.1782250-1-Ilia.Gavrilov@infotecs.ru (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net-next] udp: fix incorrect parameter validation in the udp_lib_getsockopt() function | expand |
Gavrilov Ilia wrote: > The 'len' variable can't be negative because all 'min_t' parameters > cast to unsigned int, and then the minimum one is chosen. > > To fix it, move the if statement higher. > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru> Reviewed-by: Willem de Bruijn <willemb@google.com>
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index e474b201900f..17231c0f8830 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -2792,11 +2792,11 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname, if (get_user(len, optlen)) return -EFAULT; - len = min_t(unsigned int, len, sizeof(int)); - if (len < 0) return -EINVAL; + len = min_t(unsigned int, len, sizeof(int)); + switch (optname) { case UDP_CORK: val = udp_test_bit(CORK, sk);
The 'len' variable can't be negative because all 'min_t' parameters cast to unsigned int, and then the minimum one is chosen. To fix it, move the if statement higher. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru> --- net/ipv4/udp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)