ipv6: raw: check passed optlen before reading
authorTamir Duberstein <tamird@gmail.com>
Wed, 29 Dec 2021 20:09:47 +0000 (15:09 -0500)
committerJakub Kicinski <kuba@kernel.org>
Wed, 29 Dec 2021 20:32:56 +0000 (12:32 -0800)
commitfb7bc9204095090731430c8921f9e629740c110a
tree99f8bb92eacdd49acda31dd0c5c8dc8f5827f4f3
parent5bec7ca2be6955ca1aa0d7bae2b981de9b1c9844
ipv6: raw: check passed optlen before reading

Add a check that the user-provided option is at least as long as the
number of bytes we intend to read. Before this patch we would blindly
read sizeof(int) bytes even in cases where the user passed
optlen<sizeof(int), which would potentially read garbage or fault.

Discovered by new tests in https://github.com/google/gvisor/pull/6957 .

The original get_user call predates history in the git repo.

Signed-off-by: Tamir Duberstein <tamird@gmail.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/r/20211229200947.2862255-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/ipv6/raw.c