ipv6: raw: check passed optlen before reading
authorTamir Duberstein <tamird@gmail.com>
Wed, 29 Dec 2021 20:09:47 +0000 (15:09 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 11 Jan 2022 14:25:02 +0000 (15:25 +0100)
commitf63fa1a0d4df66448c045676f2b1e722d07697a4
tree9bd16ba604c3dae20a795f210cb6530e739ca8e9
parentcf07884e6becbc654bc0b4932415faa0ba3db6cf
ipv6: raw: check passed optlen before reading

[ Upstream commit fb7bc9204095090731430c8921f9e629740c110a ]

Add a check that the user-provided option is at least as long as the
number of bytes we intend to read. Before this patch we would blindly
read sizeof(int) bytes even in cases where the user passed
optlen<sizeof(int), which would potentially read garbage or fault.

Discovered by new tests in https://github.com/google/gvisor/pull/6957 .

The original get_user call predates history in the git repo.

Signed-off-by: Tamir Duberstein <tamird@gmail.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/r/20211229200947.2862255-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/ipv6/raw.c