| Message ID | tencent_2325B98DEC12765D8CDDF9996BCFD78DAA07@qq.com (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | netfilter: x_tables: fix incorrect parameter length before call copy_from_sockptr | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Guessing tree name failed - patch did not apply |
On 4/9/24 17:00, Edward Adam Davis wrote: > If len < sizeof(tmp) it will trigger oob, so take the min of them. > > Signed-off-by: Edward Adam Davis <eadavis@qq.com> > --- > net/ipv4/netfilter/arp_tables.c | 4 ++-- > net/ipv4/netfilter/ip_tables.c | 4 ++-- > 2 files changed, 4 insertions(+), 4 deletions(-) Hi Edward Already fixed in net tree https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=0c83842df40f86e529db6842231154772c20edcc Also a followup has been sent today https://lore.kernel.org/netdev/20240409120741.3538135-1-edumazet@google.com/T/#u Thanks.
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c index 2407066b0fec..dc9166b48069 100644 --- a/net/ipv4/netfilter/arp_tables.c +++ b/net/ipv4/netfilter/arp_tables.c @@ -956,7 +956,7 @@ static int do_replace(struct net *net, sockptr_t arg, unsigned int len) void *loc_cpu_entry; struct arpt_entry *iter; - if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0) + if (copy_from_sockptr(&tmp, arg, min_t(unsigned int, sizeof(tmp), len)) != 0) return -EFAULT; /* overflow check */ @@ -1254,7 +1254,7 @@ static int compat_do_replace(struct net *net, sockptr_t arg, unsigned int len) void *loc_cpu_entry; struct arpt_entry *iter; - if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0) + if (copy_from_sockptr(&tmp, arg, min_t(unsigned int, sizeof(tmp), len)) != 0) return -EFAULT; /* overflow check */ diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c index 7da1df4997d0..94a0afd8f94f 100644 --- a/net/ipv4/netfilter/ip_tables.c +++ b/net/ipv4/netfilter/ip_tables.c @@ -1108,7 +1108,7 @@ do_replace(struct net *net, sockptr_t arg, unsigned int len) void *loc_cpu_entry; struct ipt_entry *iter; - if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0) + if (copy_from_sockptr(&tmp, arg, min_t(unsigned int, sizeof(tmp), len)) != 0) return -EFAULT; /* overflow check */ @@ -1492,7 +1492,7 @@ compat_do_replace(struct net *net, sockptr_t arg, unsigned int len) void *loc_cpu_entry; struct ipt_entry *iter; - if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0) + if (copy_from_sockptr(&tmp, arg, min_t(unsigned int, sizeof(tmp), len)) != 0) return -EFAULT; /* overflow check */
If len < sizeof(tmp) it will trigger oob, so take the min of them. Signed-off-by: Edward Adam Davis <eadavis@qq.com> --- net/ipv4/netfilter/arp_tables.c | 4 ++-- net/ipv4/netfilter/ip_tables.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)