Messages in this thread | | | Date | Thu, 3 Oct 2013 19:26:33 -0700 | Subject | Re: [PATCH v2 net-next] fix unsafe set_memory_rw from softirq | From | Alexei Starovoitov <> |
| |
On Thu, Oct 3, 2013 at 4:11 PM, Alexei Starovoitov <ast@plumgrid.com> wrote: > On Thu, Oct 3, 2013 at 4:07 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote: >> On Thu, 2013-10-03 at 15:47 -0700, Alexei Starovoitov wrote: >> >>> @@ -722,7 +725,8 @@ EXPORT_SYMBOL_GPL(sk_unattached_filter_destroy); >>> int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk) >>> { >>> struct sk_filter *fp, *old_fp; >>> - unsigned int fsize = sizeof(struct sock_filter) * fprog->len; >>> + unsigned int fsize = max(sizeof(struct sock_filter) * fprog->len, >>> + sizeof(struct work_struct)); >>> int err; >>> >>> if (sock_flag(sk, SOCK_FILTER_LOCKED)) >> >> Thats broken, as we might copy more data from user than expected, >> and eventually trigger EFAULT : >> >> if (copy_from_user(fp->insns, fprog->filter, fsize)) { > > yes. will fix.
tested on x86_64/i386 only with tcpdump and netsniff 1-4k filter size. Thank you for careful review.
| |