From: Dan Carpenter <dan.carpenter@oracle.com>
To: hch@lst.de
Cc: linux-hams@vger.kernel.org, linux-bluetooth@vger.kernel.org
Subject: [bug report] net: pass a sockptr_t into ->setsockopt
Date: Thu, 16 Dec 2021 16:05:56 +0300 [thread overview]
Message-ID: <20211216130556.GA11248@kili> (raw)
Hello Christoph Hellwig,
The patch a7b75c5a8c41: "net: pass a sockptr_t into ->setsockopt"
from Jul 23, 2020, leads to the following Smatch static checker
warnings:
net/netrom/af_netrom.c:309 nr_setsockopt() warn: not copying enough bytes for '&opt' (8 vs 4 bytes)
net/bluetooth/hci_sock.c:1940 hci_sock_setsockopt() warn: not copying enough bytes for '&opt' (4 vs 2 bytes)
net/bluetooth/l2cap_sock.c:1088 l2cap_sock_setsockopt() warn: not copying enough bytes for '&opt' (4 vs 2 bytes)
net/bluetooth/l2cap_sock.c:1119 l2cap_sock_setsockopt() warn: not copying enough bytes for '&opt' (4 vs 1 bytes)
net/ax25/af_ax25.c:546 ax25_setsockopt() warn: not copying enough bytes for '&opt' (8 vs 4 bytes)
net/netrom/af_netrom.c
296 static int nr_setsockopt(struct socket *sock, int level, int optname,
297 sockptr_t optval, unsigned int optlen)
298 {
299 struct sock *sk = sock->sk;
300 struct nr_sock *nr = nr_sk(sk);
301 unsigned long opt;
^^^^^^^^^^^^^^^^^^
302
303 if (level != SOL_NETROM)
304 return -ENOPROTOOPT;
305
306 if (optlen < sizeof(unsigned int))
307 return -EINVAL;
308
--> 309 if (copy_from_sockptr(&opt, optval, sizeof(unsigned int)))
Originally this was if (get_user(opt, (unsigned int __user *)optval))
which is weird but actually works. Now the last two bytes are
uninitialized.
310 return -EFAULT;
311
312 switch (optname) {
313 case NETROM_T1:
314 if (opt < 1 || opt > ULONG_MAX / HZ)
315 return -EINVAL;
316 nr->t1 = opt * HZ;
317 return 0;
regards,
dan carpenter
reply other threads:[~2021-12-16 13:06 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211216130556.GA11248@kili \
--to=dan.carpenter@oracle.com \
--cc=hch@lst.de \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-hams@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox