Re: [PATCH 25/26] net: pass a sockptr_t into ->setsockopt
Christoph Hellwig <[email protected]>
| Newsgroups | org.kernel.vger.dccp,dev.linux.lists.bridge,dev.linux.lists.mptcp,org.kernel.vger.bpf,org.kernel.vger.linux-bluetooth,org.kernel.vger.linux-can,org.kernel.vger.linux-crypto,org.kernel.vger.linux-hams,org.kernel.vger.linux-kernel,org.kernel.vger.linux-s390,org.kernel.vger.linux-sctp,org.kernel.vger.linux-wpan,org.kernel.vger.linux-x25,org.kernel.vger.lvs-devel,org.kernel.vger.netdev,org.kernel.vger.netfilter-devel |
|---|---|
| Message-ID | <[email protected]> |
On Thu, Aug 06, 2020 at 03:21:25PM -0700, Eric Dumazet wrote: > converting get_user(...) to copy_from_sockptr(...) really assumed the optlen > has been validated to be >= sizeof(int) earlier. > > Which is not always the case, for example here. Yes. And besides the bpfilter mess the main reason I even had to add the sockptr vs just copying optlen in the high-level socket code. Please take a look at the patch in the other thread to just revert to the "dumb" version everywhere.