Re: [net-next] tcp: Sanitize CMSG flags and reserved args in tcp_zerocopy_receive.
flat view
From: Jakub Kicinski <kuba@kernel.org>
Date: 2021-02-12 02:09:36
On Thu, 11 Feb 2021 13:21:07 -0800 Arjun Roy wrote:
quoted hunk ↗ jump to hunk
+ if (unlikely(len > sizeof(zc))) { + err = check_zeroed_user(optval + sizeof(zc), + len - sizeof(zc)); + if (err < 1) + return err == 0 ? -EINVAL : err;
nit: return err ? : -EINVAL;
quoted hunk ↗ jump to hunk
len = sizeof(zc); if (put_user(len, optlen)) return -EFAULT; } if (copy_from_user(&zc, optval, len)) return -EFAULT; + if (zc.reserved) + return -EINVAL; + if (zc.msg_flags & ~(TCP_VALID_ZC_MSG_FLAGS))
nit: parens unnecessary But neither is a big deal: Acked-by: Jakub Kicinski <kuba@kernel.org>