Re: [PATCH v2] net/packet: initialize val in packet_getsockopt()

From	David Miller <davem@davemloft.net>
Newsgroups	linux.kernel
Subject	Re: [PATCH v2] net/packet: initialize val in packet_getsockopt()
Date	2017-04-25 17:50 +0200
Message-ID	<tAaT1-6BR-49@gated-at.bofh.it> (permalink)
References	<tzLKX-75O-27@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

From: Alexander Potapenko <glider@google.com>
Date: Mon, 24 Apr 2017 14:59:14 +0200

> In the case getsockopt() is called with PACKET_HDRLEN and optlen < 4
> |val| remains uninitialized and the syscall may behave differently
> depending on its value. This doesn't have security consequences (as the
> uninit bytes aren't copied back), but it's still cleaner to initialize
> |val| and ensure optlen is not less than sizeof(int).
> 
> This bug has been detected with KMSAN.
> 
> Signed-off-by: Alexander Potapenko <glider@google.com>
> ---
> v2: - if len < sizeof(int), make it 0

No, you should signal an error if the len is too small.

Returning zero bytes to userspace silently makes the user think that
he got the data he asked for.

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Re: [PATCH v2] net/packet: initialize val in packet_getsockopt() David Miller <davem@davemloft.net> - 2017-04-25 17:50 +0200
  Re: [PATCH v2] net/packet: initialize val in packet_getsockopt() Alexander Potapenko <glider@google.com> - 2017-04-25 18:30 +0200
    Re: [PATCH v2] net/packet: initialize val in packet_getsockopt() Alexander Potapenko <glider@google.com> - 2017-04-25 18:40 +0200
    Re: [PATCH v2] net/packet: initialize val in packet_getsockopt() David Miller <davem@davemloft.net> - 2017-04-25 18:40 +0200

csiph-web