Patch "llc: Improve setsockopt() handling of malformed user input" has been added to the 6.1-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    llc: Improve setsockopt() handling of malformed user input

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     llc-improve-setsockopt-handling-of-malformed-user-in.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 344d7d1a2481bc384e5cb26b9f7ae0309ec5e4de
Author: Michal Luczaj <mhal@xxxxxxx>
Date:   Tue Nov 19 14:31:41 2024 +0100

    llc: Improve setsockopt() handling of malformed user input
    
    [ Upstream commit 1465036b10be4b8b00eb31c879e86de633ad74c1 ]
    
    copy_from_sockptr() is used incorrectly: return value is the number of
    bytes that could not be copied. Since it's deprecated, switch to
    copy_safe_from_sockptr().
    
    Note: Keeping the `optlen != sizeof(int)` check as copy_safe_from_sockptr()
    by itself would also accept optlen > sizeof(int). Which would allow a more
    lenient handling of inputs.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Suggested-by: David Wei <dw@xxxxxxxxxxx>
    Signed-off-by: Michal Luczaj <mhal@xxxxxxx>
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 8e3be0009f609..447031c5eac4d 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -1099,7 +1099,7 @@ static int llc_ui_setsockopt(struct socket *sock, int level, int optname,
 	lock_sock(sk);
 	if (unlikely(level != SOL_LLC || optlen != sizeof(int)))
 		goto out;
-	rc = copy_from_sockptr(&opt, optval, sizeof(opt));
+	rc = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
 	if (rc)
 		goto out;
 	rc = -EINVAL;




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux