Commit d1524d04 authored Nov 28, 2024 by Paolo Abeni

Merge branch 'net-fix-some-callers-of-copy_from_sockptr'



Michal Luczaj says:

====================
net: Fix some callers of copy_from_sockptr()

Some callers misinterpret copy_from_sockptr()'s return value. The function
follows copy_from_user(), i.e. returns 0 for success, or the number of
bytes not copied on error. Simply returning the result in a non-zero case
isn't usually what was intended.

Compile tested with CONFIG_LLC, CONFIG_AF_RXRPC, CONFIG_BT enabled.

Last patch probably belongs more to net-next, if any. Here as an RFC.

Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Michal Luczaj <mhal@rbox.co>
====================

Link: https://patch.msgid.link/20241119-sockptr-copy-fixes-v3-0-d752cac4be8e@rbox.co


Signed-off-by: Paolo Abeni <pabeni@redhat.com>

parents 5dfd7d94 49b2b973

include/linux/sockptr.h

+2 −0

Original line number	Diff line number	Diff line
		@@ -53,6 +53,8 @@ static inline int copy_from_sockptr_offset(void *dst, sockptr_t src,
		/* Deprecated.
		* This is unsafe, unless caller checked user provided optlen.
		* Prefer copy_safe_from_sockptr() instead.
		*
		* Returns 0 for success, or number of bytes not copied on error.
		*/
		static inline int copy_from_sockptr(void *dst, sockptr_t src, size_t size)
		{

net/llc/af_llc.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1098,7 +1098,7 @@ static int llc_ui_setsockopt(struct socket *sock, int level, int optname,
		lock_sock(sk);
		if (unlikely(level != SOL_LLC \|\| optlen != sizeof(int)))
		goto out;
		rc = copy_from_sockptr(&opt, optval, sizeof(opt));
		rc = copy_safe_from_sockptr(&opt, sizeof(opt), optval, optlen);
		if (rc)
		goto out;
		rc = -EINVAL;

net/rxrpc/af_rxrpc.c

+4 −3

Original line number	Diff line number	Diff line
		@@ -707,9 +707,10 @@ static int rxrpc_setsockopt(struct socket *sock, int level, int optname,
		ret = -EISCONN;
		if (rx->sk.sk_state != RXRPC_UNBOUND)
		goto error;
		ret = copy_from_sockptr(&min_sec_level, optval,
		sizeof(unsigned int));
		if (ret < 0)
		ret = copy_safe_from_sockptr(&min_sec_level,
		sizeof(min_sec_level),
		optval, optlen);
		if (ret)
		goto error;
		ret = -EINVAL;
		if (min_sec_level > RXRPC_SECURITY_MAX)