Commit 425e6444 authored by Peter Seiderer's avatar Peter Seiderer Committed by Jakub Kicinski
Browse files

net: pktgen: fix access outside of user given buffer in pktgen_thread_write() 



Honour the user given buffer size for the strn_len() calls (otherwise
strn_len() will access memory outside of the user given buffer).

Signed-off-by: default avatarPeter Seiderer <ps.report@gmx.net>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250219084527.20488-8-ps.report@gmx.net


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 1e5e5113

net/core/pktgen.c

+4 −3
Original line number Diff line number Diff line
@@ -1900,8 +1900,8 @@ static ssize_t pktgen_thread_write(struct file *file, 
	i = len;



	/* Read variable name */



	len = strn_len(&user_buffer[i], sizeof(name) - 1);

	max = min(sizeof(name) - 1, count - i);

	len = strn_len(&user_buffer[i], max);

	if (len < 0)

		return len;
@@ -1931,7 +1931,8 @@ static ssize_t pktgen_thread_write(struct file *file, 
	if (!strcmp(name, "add_device")) {

		char f[32];

		memset(f, 0, 32);

		len = strn_len(&user_buffer[i], sizeof(f) - 1);

		max = min(sizeof(f) - 1, count - i);

		len = strn_len(&user_buffer[i], max);

		if (len < 0) {

			ret = len;

			goto out;