diff options
| author |   Peter Seiderer <ps.report@gmx.net> | 2025-03-17 10:04:00 +0100 |
|---|---|---|
| committer |   Jakub Kicinski <kuba@kernel.org> | 2025-03-24 12:01:37 -0700 |
| commit | 7151062c297cc500d2a3b3723c83ff15f65332b4 (patch) | |
| tree | 0a78e983548a69dc36caf48901faa308d04a2262 | |
| parent | MAINTAINERS: adjust the file entry in INTEL PMC CORE DRIVER (diff) | |
| download | wireguard-linux-7151062c297cc500d2a3b3723c83ff15f65332b4.tar.xz wireguard-linux-7151062c297cc500d2a3b3723c83ff15f65332b4.zip | |
net: pktgen: add strict buffer parsing index check
Add strict buffer parsing index check to avoid the following Smatch
warning:
net/core/pktgen.c:877 get_imix_entries()
warn: check that incremented offset 'i' is capped
Checking the buffer index i after every get_user/i++ step and returning
with error code immediately avoids the current indirect (but correct)
error handling.
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/netdev/36cf3ee2-38b1-47e5-a42a-363efeb0ace3@stanley.mountain/
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250317090401.1240704-1-ps.report@gmx.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | net/core/pktgen.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/net/core/pktgen.c b/net/core/pktgen.c index e850598db3e7..fe7fdefab994 100644 --- a/net/core/pktgen.c +++ b/net/core/pktgen.c @@ -856,6 +856,9 @@ static ssize_t get_imix_entries(const char __user *buffer, if (pkt_dev->n_imix_entries >= MAX_IMIX_ENTRIES) return -E2BIG; + if (i >= maxlen) + return -EINVAL; + max = min(10, maxlen - i); len = num_arg(&buffer[i], max, &size); if (len < 0) @@ -869,6 +872,8 @@ static ssize_t get_imix_entries(const char __user *buffer, if (c != ',') return -EINVAL; i++; + if (i >= maxlen) + return -EINVAL; if (size < 14 + 20 + 8) size = 14 + 20 + 8; @@ -911,6 +916,9 @@ static ssize_t get_labels(const char __user *buffer, if (n >= MAX_MPLS_LABELS) return -E2BIG; + if (i >= maxlen) + return -EINVAL; + max = min(8, maxlen - i); len = hex32_arg(&buffer[i], max, &tmp); if (len < 0) |