shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-11 13:27:06 +09:00
Code Issues Packages Projects Releases Wiki Activity

net: pktgen: fix access outside of user given buffer in pktgen_thread_write()

Browse Source 
[ Upstream commit 425e64440ad0a2f03bdaf04be0ae53dededbaa77 ]

Honour the user given buffer size for the strn_len() calls (otherwise
strn_len() will access memory outside of the user given buffer).

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250219084527.20488-8-ps.report@gmx.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Peter Seiderer
2025-02-19 09:45:27 +01:00
committed by Greg Kroah-Hartman
parent 70a9888018
commit ef1158a6a6
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
net/core/pktgen.c
View File

@@ -1877,8 +1877,8 @@ static ssize_t pktgen_thread_write(struct file *file,
i = len; i = len;
/* Read variable name */ /* Read variable name */
max = min(sizeof(name) - 1, count - i);
len = strn_len(&user_buffer[i], sizeof(name) - 1); len = strn_len(&user_buffer[i], max);
if (len < 0) if (len < 0)
return len; return len;
@@ -1908,7 +1908,8 @@ static ssize_t pktgen_thread_write(struct file *file,
if (!strcmp(name, "add_device")) { if (!strcmp(name, "add_device")) {
char f[32]; char f[32];
memset(f, 0, 32); memset(f, 0, 32);
len = strn_len(&user_buffer[i], sizeof(f) - 1); max = min(sizeof(f) - 1, count - i);
len = strn_len(&user_buffer[i], max);
if (len < 0) { if (len < 0) {
ret = len; ret = len;
goto out; goto out;