]> git.hungrycats.org Git - linux/commit
rxrpc: Improve setsockopt() handling of malformed user input
authorMichal Luczaj <mhal@rbox.co>
Tue, 19 Nov 2024 13:31:42 +0000 (14:31 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 5 Dec 2024 13:02:35 +0000 (14:02 +0100)
commit8052a9b9714d181ac71b44ef1b8a0656738d420c
tree736dd351285766f25317bca2eb4ad02f63b80d22
parent3c0e013b9ffebc6d30c99e467e837cebfe4e6147
rxrpc: Improve setsockopt() handling of malformed user input

[ Upstream commit 02020056647017e70509bb58c3096448117099e1 ]

copy_from_sockptr() does not return negative value on error; instead, it
reports the number of bytes that failed to copy. Since it's deprecated,
switch to copy_safe_from_sockptr().

Note: Keeping the `optlen != sizeof(unsigned int)` check as
copy_safe_from_sockptr() by itself would also accept
optlen > sizeof(unsigned int). Which would allow a more lenient handling
of inputs.

Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
Signed-off-by: Michal Luczaj <mhal@rbox.co>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/rxrpc/af_rxrpc.c