* [PATCH v2] net/sctp: Validate parameter size for SCTP_GET_ASSOC_STATS
@ 2013-02-27 20:57 ` Guenter Roeck
0 siblings, 0 replies; 6+ messages in thread
From: Guenter Roeck @ 2013-02-27 20:57 UTC (permalink / raw)
To: netdev
Cc: linux-sctp, Vlad Yasevich, Sridhar Samudrala, Neil Horman,
David S. Miller, Guenter Roeck
Building sctp may fail with:
In function ‘copy_from_user’,
inlined from ‘sctp_getsockopt_assoc_stats’ at
net/sctp/socket.c:5656:20:
arch/x86/include/asm/uaccess_32.h:211:26: error: call to
‘copy_from_user_overflow’ declared with attribute error: copy_from_user()
buffer size is not provably correct
if built with W=1 due to a missing parameter size validation
before the call to copy_from_user.
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
---
v2: Fix by moving the existing parameter size validation up
in the function instead of adding an additional one.
net/sctp/socket.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index cedd9bf..9ef5c73 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5653,6 +5653,9 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
if (len < sizeof(sctp_assoc_t))
return -EINVAL;
+ /* Allow the struct to grow and fill in as much as possible */
+ len = min_t(size_t, len, sizeof(sas));
+
if (copy_from_user(&sas, optval, len))
return -EFAULT;
@@ -5686,9 +5689,6 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
/* Mark beginning of a new observation period */
asoc->stats.max_obs_rto = asoc->rto_min;
- /* Allow the struct to grow and fill in as much as possible */
- len = min_t(size_t, len, sizeof(sas));
-
if (put_user(len, optlen))
return -EFAULT;
--
1.7.9.7
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH v2] net/sctp: Validate parameter size for SCTP_GET_ASSOC_STATS
@ 2013-02-27 20:57 ` Guenter Roeck
0 siblings, 0 replies; 6+ messages in thread
From: Guenter Roeck @ 2013-02-27 20:57 UTC (permalink / raw)
To: netdev
Cc: linux-sctp, Vlad Yasevich, Sridhar Samudrala, Neil Horman,
David S. Miller, Guenter Roeck
Building sctp may fail with:
In function ‘copy_from_user’,
inlined from ‘sctp_getsockopt_assoc_stats’ at
net/sctp/socket.c:5656:20:
arch/x86/include/asm/uaccess_32.h:211:26: error: call to
‘copy_from_user_overflow’ declared with attribute error: copy_from_user()
buffer size is not provably correct
if built with W=1 due to a missing parameter size validation
before the call to copy_from_user.
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
---
v2: Fix by moving the existing parameter size validation up
in the function instead of adding an additional one.
net/sctp/socket.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index cedd9bf..9ef5c73 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5653,6 +5653,9 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
if (len < sizeof(sctp_assoc_t))
return -EINVAL;
+ /* Allow the struct to grow and fill in as much as possible */
+ len = min_t(size_t, len, sizeof(sas));
+
if (copy_from_user(&sas, optval, len))
return -EFAULT;
@@ -5686,9 +5689,6 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
/* Mark beginning of a new observation period */
asoc->stats.max_obs_rto = asoc->rto_min;
- /* Allow the struct to grow and fill in as much as possible */
- len = min_t(size_t, len, sizeof(sas));
-
if (put_user(len, optlen))
return -EFAULT;
--
1.7.9.7
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2] net/sctp: Validate parameter size for SCTP_GET_ASSOC_STATS
2013-02-27 20:57 ` Guenter Roeck
@ 2013-02-27 21:00 ` Vlad Yasevich
-1 siblings, 0 replies; 6+ messages in thread
From: Vlad Yasevich @ 2013-02-27 21:00 UTC (permalink / raw)
To: Guenter Roeck
Cc: netdev, linux-sctp, Sridhar Samudrala, Neil Horman,
David S. Miller
On 02/27/2013 03:57 PM, Guenter Roeck wrote:
> Building sctp may fail with:
>
> In function ‘copy_from_user’,
> inlined from ‘sctp_getsockopt_assoc_stats’ at
> net/sctp/socket.c:5656:20:
> arch/x86/include/asm/uaccess_32.h:211:26: error: call to
> ‘copy_from_user_overflow’ declared with attribute error: copy_from_user()
> buffer size is not provably correct
>
> if built with W=1 due to a missing parameter size validation
> before the call to copy_from_user.
>
> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
> ---
> v2: Fix by moving the existing parameter size validation up
> in the function instead of adding an additional one.
This works too...
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
>
> net/sctp/socket.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/net/sctp/socket.c b/net/sctp/socket.c
> index cedd9bf..9ef5c73 100644
> --- a/net/sctp/socket.c
> +++ b/net/sctp/socket.c
> @@ -5653,6 +5653,9 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
> if (len < sizeof(sctp_assoc_t))
> return -EINVAL;
>
> + /* Allow the struct to grow and fill in as much as possible */
> + len = min_t(size_t, len, sizeof(sas));
> +
> if (copy_from_user(&sas, optval, len))
> return -EFAULT;
>
> @@ -5686,9 +5689,6 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
> /* Mark beginning of a new observation period */
> asoc->stats.max_obs_rto = asoc->rto_min;
>
> - /* Allow the struct to grow and fill in as much as possible */
> - len = min_t(size_t, len, sizeof(sas));
> -
> if (put_user(len, optlen))
> return -EFAULT;
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] net/sctp: Validate parameter size for SCTP_GET_ASSOC_STATS
@ 2013-02-27 21:00 ` Vlad Yasevich
0 siblings, 0 replies; 6+ messages in thread
From: Vlad Yasevich @ 2013-02-27 21:00 UTC (permalink / raw)
To: Guenter Roeck
Cc: netdev, linux-sctp, Sridhar Samudrala, Neil Horman,
David S. Miller
On 02/27/2013 03:57 PM, Guenter Roeck wrote:
> Building sctp may fail with:
>
> In function ‘copy_from_user’,
> inlined from ‘sctp_getsockopt_assoc_stats’ at
> net/sctp/socket.c:5656:20:
> arch/x86/include/asm/uaccess_32.h:211:26: error: call to
> ‘copy_from_user_overflow’ declared with attribute error: copy_from_user()
> buffer size is not provably correct
>
> if built with W=1 due to a missing parameter size validation
> before the call to copy_from_user.
>
> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
> ---
> v2: Fix by moving the existing parameter size validation up
> in the function instead of adding an additional one.
This works too...
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
>
> net/sctp/socket.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/net/sctp/socket.c b/net/sctp/socket.c
> index cedd9bf..9ef5c73 100644
> --- a/net/sctp/socket.c
> +++ b/net/sctp/socket.c
> @@ -5653,6 +5653,9 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
> if (len < sizeof(sctp_assoc_t))
> return -EINVAL;
>
> + /* Allow the struct to grow and fill in as much as possible */
> + len = min_t(size_t, len, sizeof(sas));
> +
> if (copy_from_user(&sas, optval, len))
> return -EFAULT;
>
> @@ -5686,9 +5689,6 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
> /* Mark beginning of a new observation period */
> asoc->stats.max_obs_rto = asoc->rto_min;
>
> - /* Allow the struct to grow and fill in as much as possible */
> - len = min_t(size_t, len, sizeof(sas));
> -
> if (put_user(len, optlen))
> return -EFAULT;
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] net/sctp: Validate parameter size for SCTP_GET_ASSOC_STATS
2013-02-27 21:00 ` Vlad Yasevich
@ 2013-02-27 21:08 ` David Miller
-1 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2013-02-27 21:08 UTC (permalink / raw)
To: vyasevich; +Cc: linux, netdev, linux-sctp, sri, nhorman
RnJvbTogVmxhZCBZYXNldmljaCA8dnlhc2V2aWNoQGdtYWlsLmNvbT4NCkRhdGU6IFdlZCwgMjcg
RmViIDIwMTMgMTY6MDA6NDIgLTA1MDANCg0KPiBPbiAwMi8yNy8yMDEzIDAzOjU3IFBNLCBHdWVu
dGVyIFJvZWNrIHdyb3RlOg0KPj4gQnVpbGRpbmcgc2N0cCBtYXkgZmFpbCB3aXRoOg0KPj4NCj4+
IEluIGZ1bmN0aW9uIKFjb3B5X2Zyb21fdXNlcqIsDQo+PiAgICAgIGlubGluZWQgZnJvbSChc2N0
cF9nZXRzb2Nrb3B0X2Fzc29jX3N0YXRzoiBhdA0KPj4gICAgICBuZXQvc2N0cC9zb2NrZXQuYzo1
NjU2OjIwOg0KPj4gYXJjaC94ODYvaW5jbHVkZS9hc20vdWFjY2Vzc18zMi5oOjIxMToyNjogZXJy
b3I6IGNhbGwgdG8NCj4+ICAgICAgoWNvcHlfZnJvbV91c2VyX292ZXJmbG93oiBkZWNsYXJlZCB3
aXRoIGF0dHJpYnV0ZSBlcnJvcjoNCj4+ICAgICAgY29weV9mcm9tX3VzZXIoKQ0KPj4gICAgICBi
dWZmZXIgc2l6ZSBpcyBub3QgcHJvdmFibHkgY29ycmVjdA0KPj4NCj4+IGlmIGJ1aWx0IHdpdGgg
Vz0xIGR1ZSB0byBhIG1pc3NpbmcgcGFyYW1ldGVyIHNpemUgdmFsaWRhdGlvbg0KPj4gYmVmb3Jl
IHRoZSBjYWxsIHRvIGNvcHlfZnJvbV91c2VyLg0KPj4NCj4+IFNpZ25lZC1vZmYtYnk6IEd1ZW50
ZXIgUm9lY2sgPGxpbnV4QHJvZWNrLXVzLm5ldD4NCj4+IC0tLQ0KPj4gdjI6IEZpeCBieSBtb3Zp
bmcgdGhlIGV4aXN0aW5nIHBhcmFtZXRlciBzaXplIHZhbGlkYXRpb24gdXANCj4+ICAgICAgaW4g
dGhlIGZ1bmN0aW9uIGluc3RlYWQgb2YgYWRkaW5nIGFuIGFkZGl0aW9uYWwgb25lLg0KPiANCj4g
VGhpcyB3b3JrcyB0b28uLi4NCj4gDQo+IEFja2VkLWJ5OiBWbGFkIFlhc2V2aWNoIDx2eWFzZXZp
Y2hAZ21haWwuY29tPg0KDQpJJ2xsIGFwcGx5IHRoaXMgYW5kIHF1ZXVlIGl0IHVwIGZvciAtc3Rh
YmxlLCB0aGFua3MgZXZlcnlvbmUuDQo
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] net/sctp: Validate parameter size for SCTP_GET_ASSOC_STATS
@ 2013-02-27 21:08 ` David Miller
0 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2013-02-27 21:08 UTC (permalink / raw)
To: vyasevich; +Cc: linux, netdev, linux-sctp, sri, nhorman
From: Vlad Yasevich <vyasevich@gmail.com>
Date: Wed, 27 Feb 2013 16:00:42 -0500
> On 02/27/2013 03:57 PM, Guenter Roeck wrote:
>> Building sctp may fail with:
>>
>> In function ‘copy_from_user’,
>> inlined from ‘sctp_getsockopt_assoc_stats’ at
>> net/sctp/socket.c:5656:20:
>> arch/x86/include/asm/uaccess_32.h:211:26: error: call to
>> ‘copy_from_user_overflow’ declared with attribute error:
>> copy_from_user()
>> buffer size is not provably correct
>>
>> if built with W=1 due to a missing parameter size validation
>> before the call to copy_from_user.
>>
>> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
>> ---
>> v2: Fix by moving the existing parameter size validation up
>> in the function instead of adding an additional one.
>
> This works too...
>
> Acked-by: Vlad Yasevich <vyasevich@gmail.com>
I'll apply this and queue it up for -stable, thanks everyone.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2013-02-27 21:08 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-02-27 20:57 [PATCH v2] net/sctp: Validate parameter size for SCTP_GET_ASSOC_STATS Guenter Roeck
2013-02-27 20:57 ` Guenter Roeck
2013-02-27 21:00 ` Vlad Yasevich
2013-02-27 21:00 ` Vlad Yasevich
2013-02-27 21:08 ` David Miller
2013-02-27 21:08 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.