Re: [PATCH] Prevent out-of-bounds read/write in bcmasp_netfilt_rd and bcmasp_netfilt_wr
From: Yuran Pereira <hidden>
Date: 2023-11-03 13:43:16
Also in:
linux-kernel-mentees, lkml
From: Yuran Pereira <hidden>
Date: 2023-11-03 13:43:16
Also in:
linux-kernel-mentees, lkml
Hello Greg, On Fri, Nov 03, 2023 at 01:57:13PM +0100, Greg KH wrote:
quoted
reg_offset = bcmasp_netfilt_get_reg_offset(priv, nfilt, reg_type, offset); + if (reg_offset < 0) + return 0;Shouldn't you return an error here?
Yes, I think that makes sense. I might just return `reg_offset` since it is bound to be -EINVAL when bcmasp_netfilt_get_reg_offset fails. But that now makes me wonder whether the previous check in that function which currently returns 0, shouldn't be returning `-EINVAL` instead.
static u32 bcmasp_netfilt_rd(struct bcmasp_priv *priv,
...
{
if (!IS_ALIGNED(offset, 4) || offset > MAX_WAKE_FILTER_SIZE)
return 0; <----- Should this one be -EINVAL?
}
Thank you for the feedback. Yuran