Re: [PATCH 25/26] net: pass a sockptr_t into ->setsockopt
From: Eric Dumazet <hidden>
Date: 2020-08-06 22:21:36
Also in:
bpf, bridge, linux-bluetooth, linux-can, linux-crypto, linux-hams, linux-s390, linux-sctp, lkml, lvs-devel, mptcp, netfilter-devel
On 7/22/20 11:09 PM, Christoph Hellwig wrote:
Rework the remaining setsockopt code to pass a sockptr_t instead of a plain user pointer. This removes the last remaining set_fs(KERNEL_DS) outside of architecture specific code. Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Stefan Schmidt <stefan@datenfreihafen.org> [ieee802154] ---
...
quoted hunk ↗ jump to hunk
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c index 594e01ad670aa6..874f01cd7aec42 100644 --- a/net/ipv6/raw.c +++ b/net/ipv6/raw.c@@ -972,13 +972,13 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) }
...
static int do_rawv6_setsockopt(struct sock *sk, int level, int optname,
- char __user *optval, unsigned int optlen)
+ sockptr_t optval, unsigned int optlen)
{
struct raw6_sock *rp = raw6_sk(sk);
int val;
- if (get_user(val, (int __user *)optval))
+ if (copy_from_sockptr(&val, optval, sizeof(val)))
return -EFAULT;
converting get_user(...) to copy_from_sockptr(...) really assumed the optlen has been validated to be >= sizeof(int) earlier. Which is not always the case, for example here. User application can fool us passing optlen=0, and a user pointer of exactly TASK_SIZE-1