ipv6: raw: check passed optlen before reading
authorTamir Duberstein <tamird@gmail.com>
Wed, 29 Dec 2021 20:09:47 +0000 (15:09 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 11 Jan 2022 14:35:18 +0000 (15:35 +0100)
commitec33da9ae07227fe322f56b2b747652a910c6e8f
treea084bfd72ebe59681a298720ce85065832209645
parent04d945934362fe3c329fc84324523bf652e89719
ipv6: raw: check passed optlen before reading

[ Upstream commit fb7bc9204095090731430c8921f9e629740c110a ]

Add a check that the user-provided option is at least as long as the
number of bytes we intend to read. Before this patch we would blindly
read sizeof(int) bytes even in cases where the user passed
optlen<sizeof(int), which would potentially read garbage or fault.

Discovered by new tests in https://github.com/google/gvisor/pull/6957 .

The original get_user call predates history in the git repo.

Signed-off-by: Tamir Duberstein <tamird@gmail.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/r/20211229200947.2862255-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/ipv6/raw.c