| Message ID | 20241213172518.2415666-1-edumazet@google.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | ee76746387f6233bdfa93d7406990f923641568f |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] netdevsim: prevent bad user input in nsim_dev_health_break_write() | expand |
On Fri, Dec 13, 2024 at 05:25:18PM +0000, Eric Dumazet wrote: > If either a zero count or a large one is provided, kernel can crash. > > Fixes: 82c93a87bf8b ("netdevsim: implement couple of testing devlink health reporters") > Reported-by: syzbot+ea40e4294e58b0292f74@syzkaller.appspotmail.com > Closes: https://lore.kernel.org/netdev/675c6862.050a0220.37aaf.00b1.GAE@google.com/T/#u > Signed-off-by: Eric Dumazet <edumazet@google.com> > Cc: Jiri Pirko <jiri@nvidia.com> > --- > drivers/net/netdevsim/health.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/net/netdevsim/health.c b/drivers/net/netdevsim/health.c > index 70e8bdf34be900f744e821fb237641a27bb71a7b..688f05316b5e109fc84222476023f3f1f078cf28 100644 > --- a/drivers/net/netdevsim/health.c > +++ b/drivers/net/netdevsim/health.c > @@ -149,6 +149,8 @@ static ssize_t nsim_dev_health_break_write(struct file *file, > char *break_msg; > int err; > > + if (count == 0 || count > PAGE_SIZE) > + return -EINVAL; > break_msg = memdup_user_nul(data, count); > if (IS_ERR(break_msg)) > return PTR_ERR(break_msg); > -- Reviewed-by: Joe Damato <jdamato@fastly.com>
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Fri, 13 Dec 2024 17:25:18 +0000 you wrote: > If either a zero count or a large one is provided, kernel can crash. > > Fixes: 82c93a87bf8b ("netdevsim: implement couple of testing devlink health reporters") > Reported-by: syzbot+ea40e4294e58b0292f74@syzkaller.appspotmail.com > Closes: https://lore.kernel.org/netdev/675c6862.050a0220.37aaf.00b1.GAE@google.com/T/#u > Signed-off-by: Eric Dumazet <edumazet@google.com> > Cc: Jiri Pirko <jiri@nvidia.com> > > [...] Here is the summary with links: - [net] netdevsim: prevent bad user input in nsim_dev_health_break_write() https://git.kernel.org/netdev/net/c/ee76746387f6 You are awesome, thank you!
diff --git a/drivers/net/netdevsim/health.c b/drivers/net/netdevsim/health.c index 70e8bdf34be900f744e821fb237641a27bb71a7b..688f05316b5e109fc84222476023f3f1f078cf28 100644 --- a/drivers/net/netdevsim/health.c +++ b/drivers/net/netdevsim/health.c @@ -149,6 +149,8 @@ static ssize_t nsim_dev_health_break_write(struct file *file, char *break_msg; int err; + if (count == 0 || count > PAGE_SIZE) + return -EINVAL; break_msg = memdup_user_nul(data, count); if (IS_ERR(break_msg)) return PTR_ERR(break_msg);
If either a zero count or a large one is provided, kernel can crash. Fixes: 82c93a87bf8b ("netdevsim: implement couple of testing devlink health reporters") Reported-by: syzbot+ea40e4294e58b0292f74@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/675c6862.050a0220.37aaf.00b1.GAE@google.com/T/#u Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Jiri Pirko <jiri@nvidia.com> --- drivers/net/netdevsim/health.c | 2 ++ 1 file changed, 2 insertions(+)