summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChristoph Hellwig <hch@lst.de>2020-07-28 18:38:36 +0200
committerDavid S. Miller <davem@davemloft.net>2020-07-28 13:43:40 -0700
commita31edb2059ed4e498f9aa8230c734b59d0ad797a (patch)
tree050f16554295c22db098bb4e81021e21d2718c5f
parentd3c48151512922dd35f1f393b30b9138e4441d14 (diff)
net: improve the user pointer check in init_user_sockptr
Make sure not just the pointer itself but the whole range lies in the user address space. For that pass the length and then use the access_ok helper to do the check. Fixes: 6d04fe15f78a ("net: optimize the sockptr_t for unified kernel/user address spaces") Reported-by: David Laight <David.Laight@ACULAB.COM> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--include/linux/sockptr.h18
-rw-r--r--net/ipv4/bpfilter/sockopt.c2
-rw-r--r--net/socket.c2
3 files changed, 8 insertions, 14 deletions
diff --git a/include/linux/sockptr.h b/include/linux/sockptr.h
index 9e6c81d474cb..96840def9d69 100644
--- a/include/linux/sockptr.h
+++ b/include/linux/sockptr.h
@@ -27,14 +27,6 @@ static inline sockptr_t KERNEL_SOCKPTR(void *p)
{
return (sockptr_t) { .kernel = p };
}
-
-static inline int __must_check init_user_sockptr(sockptr_t *sp, void __user *p)
-{
- if ((unsigned long)p >= TASK_SIZE)
- return -EFAULT;
- sp->user = p;
- return 0;
-}
#else /* CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE */
typedef struct {
union {
@@ -53,14 +45,16 @@ static inline sockptr_t KERNEL_SOCKPTR(void *p)
{
return (sockptr_t) { .kernel = p, .is_kernel = true };
}
+#endif /* CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE */
-static inline int __must_check init_user_sockptr(sockptr_t *sp, void __user *p)
+static inline int __must_check init_user_sockptr(sockptr_t *sp, void __user *p,
+ size_t size)
{
- sp->user = p;
- sp->is_kernel = false;
+ if (!access_ok(p, size))
+ return -EFAULT;
+ *sp = (sockptr_t) { .user = p };
return 0;
}
-#endif /* CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE */
static inline bool sockptr_is_null(sockptr_t sockptr)
{
diff --git a/net/ipv4/bpfilter/sockopt.c b/net/ipv4/bpfilter/sockopt.c
index 94f18d2352d0..545b2640f019 100644
--- a/net/ipv4/bpfilter/sockopt.c
+++ b/net/ipv4/bpfilter/sockopt.c
@@ -65,7 +65,7 @@ int bpfilter_ip_get_sockopt(struct sock *sk, int optname,
if (get_user(len, optlen))
return -EFAULT;
- err = init_user_sockptr(&optval, user_optval);
+ err = init_user_sockptr(&optval, user_optval, len);
if (err)
return err;
return bpfilter_mbox_request(sk, optname, optval, len, false);
diff --git a/net/socket.c b/net/socket.c
index 94ca4547cd7c..aff52e81653c 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2105,7 +2105,7 @@ int __sys_setsockopt(int fd, int level, int optname, char __user *user_optval,
if (optlen < 0)
return -EINVAL;
- err = init_user_sockptr(&optval, user_optval);
+ err = init_user_sockptr(&optval, user_optval, optlen);
if (err)
return err;