diff options
author | David S. Miller <davem@davemloft.net> | 2024-03-11 12:53:22 +0300 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2024-03-11 12:53:22 +0300 |
commit | e996401e06a5232f61b4906e2eea643fffa88396 (patch) | |
tree | 48f20850b5f6836baccc5e1e5c8bb01efe7ac1df /net | |
parent | c2b25092864a16c7865e406badedece5cc25fc2b (diff) | |
parent | d6eb8de2015f0c24822e47356f839167ebde2945 (diff) | |
download | linux-e996401e06a5232f61b4906e2eea643fffa88396.tar.xz |
Merge branch 'getsockopt-parameter-validation'
Gavrilov Ilia says:
====================
fix incorrect parameter validation in the *_get_sockopt() functions
This v2 series fix incorrent parameter validation in *_get_sockopt()
functions in several places.
version 2 changes:
- reword the patch description
- add two patches for net/kcm and net/x25
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r-- | net/ipv4/ipmr.c | 4 | ||||
-rw-r--r-- | net/ipv4/tcp.c | 4 | ||||
-rw-r--r-- | net/ipv4/udp.c | 4 | ||||
-rw-r--r-- | net/kcm/kcmsock.c | 3 | ||||
-rw-r--r-- | net/l2tp/l2tp_ppp.c | 4 | ||||
-rw-r--r-- | net/x25/af_x25.c | 4 |
6 files changed, 13 insertions, 10 deletions
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c index 0708ac6f6c58..fd5c01c8489f 100644 --- a/net/ipv4/ipmr.c +++ b/net/ipv4/ipmr.c @@ -1603,9 +1603,11 @@ int ip_mroute_getsockopt(struct sock *sk, int optname, sockptr_t optval, if (copy_from_sockptr(&olr, optlen, sizeof(int))) return -EFAULT; - olr = min_t(unsigned int, olr, sizeof(int)); if (olr < 0) return -EINVAL; + + olr = min_t(unsigned int, olr, sizeof(int)); + if (copy_to_sockptr(optlen, &olr, sizeof(int))) return -EFAULT; if (copy_to_sockptr(optval, &val, olr)) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index c5b83875411a..b091149742b1 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -4011,11 +4011,11 @@ int do_tcp_getsockopt(struct sock *sk, int level, if (copy_from_sockptr(&len, optlen, sizeof(int))) return -EFAULT; - len = min_t(unsigned int, len, sizeof(int)); - if (len < 0) return -EINVAL; + len = min_t(unsigned int, len, sizeof(int)); + switch (optname) { case TCP_MAXSEG: val = tp->mss_cache; diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 2beabf5b2d86..43ec4812b60e 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -2791,11 +2791,11 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname, if (get_user(len, optlen)) return -EFAULT; - len = min_t(unsigned int, len, sizeof(int)); - if (len < 0) return -EINVAL; + len = min_t(unsigned int, len, sizeof(int)); + switch (optname) { case UDP_CORK: val = udp_test_bit(CORK, sk); diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c index dc46f17a3187..2f191e50d4fc 100644 --- a/net/kcm/kcmsock.c +++ b/net/kcm/kcmsock.c @@ -1153,10 +1153,11 @@ static int kcm_getsockopt(struct socket *sock, int level, int optname, if (get_user(len, optlen)) return -EFAULT; - len = min_t(unsigned int, len, sizeof(int)); if (len < 0) return -EINVAL; + len = min_t(unsigned int, len, sizeof(int)); + switch (optname) { case KCM_RECV_DISABLE: val = kcm->rx_disabled; diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c index f011af6601c9..6146e4e67bbb 100644 --- a/net/l2tp/l2tp_ppp.c +++ b/net/l2tp/l2tp_ppp.c @@ -1356,11 +1356,11 @@ static int pppol2tp_getsockopt(struct socket *sock, int level, int optname, if (get_user(len, optlen)) return -EFAULT; - len = min_t(unsigned int, len, sizeof(int)); - if (len < 0) return -EINVAL; + len = min_t(unsigned int, len, sizeof(int)); + err = -ENOTCONN; if (!sk->sk_user_data) goto end; diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c index f7a7c7798c3b..d18d51412cc0 100644 --- a/net/x25/af_x25.c +++ b/net/x25/af_x25.c @@ -460,12 +460,12 @@ static int x25_getsockopt(struct socket *sock, int level, int optname, if (get_user(len, optlen)) goto out; - len = min_t(unsigned int, len, sizeof(int)); - rc = -EINVAL; if (len < 0) goto out; + len = min_t(unsigned int, len, sizeof(int)); + rc = -EFAULT; if (put_user(len, optlen)) goto out; |