mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2025-04-09 14:45:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

net: pktgen: add strict buffer parsing index check

Browse Source 
Add strict buffer parsing index check to avoid the following Smatch
warning:

  net/core/pktgen.c:877 get_imix_entries()
  warn: check that incremented offset 'i' is capped

Checking the buffer index i after every get_user/i++ step and returning
with error code immediately avoids the current indirect (but correct)
error handling.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/netdev/36cf3ee2-38b1-47e5-a42a-363efeb0ace3@stanley.mountain/
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250317090401.1240704-1-ps.report@gmx.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Peter Seiderer 2025-03-17 10:04:00 +01:00 committed by Jakub Kicinski
parent fd88253605
commit 7151062c29
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
net/core/pktgen.c
View File

@ -856,6 +856,9 @@ static ssize_t get_imix_entries(const char __user *buffer,
if (pkt_dev->n_imix_entries >= MAX_IMIX_ENTRIES)
return -E2BIG;
if (i >= maxlen)
return -EINVAL;
max = min(10, maxlen - i);
len = num_arg(&buffer[i], max, &size);
if (len < 0)
@ -869,6 +872,8 @@ static ssize_t get_imix_entries(const char __user *buffer,
if (c != ',')
return -EINVAL;
i++;
if (i >= maxlen)
return -EINVAL;
if (size < 14 + 20 + 8)
size = 14 + 20 + 8;
@ -911,6 +916,9 @@ static ssize_t get_labels(const char __user *buffer,
if (n >= MAX_MPLS_LABELS)
return -E2BIG;
if (i >= maxlen)
return -EINVAL;
max = min(8, maxlen - i);
len = hex32_arg(&buffer[i], max, &tmp);
if (len < 0)