diff options
| author | Tamir Duberstein <[email protected]> | 2021-12-29 15:09:47 -0500 |
|---|---|---|
| committer | Jakub Kicinski <[email protected]> | 2021-12-29 12:32:56 -0800 |
| commit | fb7bc9204095090731430c8921f9e629740c110a (patch) | |
| tree | 99f8bb92eacdd49acda31dd0c5c8dc8f5827f4f3 /net/lapb/lapb_timer.c | |
| parent | 5bec7ca2be6955ca1aa0d7bae2b981de9b1c9844 (diff) | |
ipv6: raw: check passed optlen before reading
Add a check that the user-provided option is at least as long as the
number of bytes we intend to read. Before this patch we would blindly
read sizeof(int) bytes even in cases where the user passed
optlen<sizeof(int), which would potentially read garbage or fault.
Discovered by new tests in https://github.com/google/gvisor/pull/6957 .
The original get_user call predates history in the git repo.
Signed-off-by: Tamir Duberstein <[email protected]>
Signed-off-by: Willem de Bruijn <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Diffstat (limited to 'net/lapb/lapb_timer.c')
0 files changed, 0 insertions, 0 deletions