[PATCH bpf] bpf: properly check TCP_CONGESTION optlen
From: Eric Dumazet <edumazet@google.com>
Date: 2019-02-23 19:07:14
Also in:
bpf
Subsystem:
bpf [general] (safe dynamic programs and tools), bpf [networking] (tcx & tc bpf, sock_addr), networking [general], the rest · Maintainers:
Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
If caller of bpf_setsockopt() is silly passing a negative optlen
bad things happen.
Fixes: 91b5b21c7c16 ("bpf: Add support for changing congestion control")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Lawrence Brakmo <redacted>
---
net/core/filter.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index f7d0004fc16096eb42ece3a6acf645540ee2326b..6a5d89464168f2f35f43986c1dbc0446c9390a3c 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c@@ -4194,8 +4194,9 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock, char name[TCP_CA_NAME_MAX]; bool reinit = bpf_sock->op > BPF_SOCK_OPS_NEEDS_ECN; - strncpy(name, optval, min_t(long, optlen, - TCP_CA_NAME_MAX-1)); + if (optlen < 0) + return -EINVAL; + strncpy(name, optval, min(optlen, TCP_CA_NAME_MAX - 1)); name[TCP_CA_NAME_MAX-1] = 0; ret = tcp_set_congestion_control(sk, name, false, reinit);
--
2.21.0.rc0.258.g878e2cd30e-goog