Re: [PATCH net] s390/qeth: validate user buffer length in SNMP and ARP query ioctls
Joe Damato <[email protected]>
| Newsgroups | org.kernel.vger.linux-s390,org.kernel.vger.linux-kernel,org.kernel.vger.netdev,org.kernel.vger.stable |
|---|---|
| Message-ID | <amt4hhb/[email protected]> |
On Thu, Jul 30, 2026 at 04:22:16PM +0200, Hidayath Khan wrote:
> qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by
> a user-supplied length (udata_len) without checking a lower bound, then
> set udata_offset to a fixed non-zero value and pass both to a reply
> callback. The callback bounds-checks the copy with
>
> if ((udata_len - udata_offset) < len)
>
> Both fields are u32, so a udata_len smaller than udata_offset makes the
> subtraction wrap and the check pass, and the following memcpy() writes
> past the allocation. A udata_len of 0 also yields ZERO_SIZE_PTR from
> kzalloc(), which the existing NULL check does not catch.
>
> Reject buffers smaller than udata_offset before allocating, so the
> callback subtraction can no longer underflow.
>
> Fixes: 4a71df50047f ("qeth: new qeth device driver")
> Cc: [email protected]
> Reviewed-by: Alexandra Winter <[email protected]>
> Signed-off-by: Hidayath Khan <[email protected]>
> ---
> drivers/s390/net/qeth_core_main.c | 3 +++
> drivers/s390/net/qeth_l3_main.c | 5 +++++
> 2 files changed, 8 insertions(+)
Reviewed-by: Joe Damato <[email protected]>