From f5804c37cfe873c30b9330458546a4bc6693f990 Mon Sep 17 00:00:00 2001 From: Wei Yongjun Date: Wed, 24 Mar 2021 22:42:20 +0800 Subject: [PATCH 1/2] netdevsim: switch to memdup_user_nul() ANBZ: #13096 commit 2fb425f27ee6ea572adeb6c259d039dea89a308e stable. commit 20fd4f421cf4c21ab37a8bf31db50c69f1b49355 upstream. Use memdup_user_nul() helper instead of open-coding to simplify the code. Reported-by: Hulk Robot Signed-off-by: Wei Yongjun Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller Stable-dep-of: ee76746387f6 ("netdevsim: prevent bad user input in nsim_dev_health_break_write()") Signed-off-by: Sasha Levin Fixes: CVE-2024-56716 Signed-off-by: Xiao Long Signed-off-by: Wen Gu --- drivers/net/netdevsim/health.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/net/netdevsim/health.c b/drivers/net/netdevsim/health.c index 21e2974660e7..04aebdf85747 100644 --- a/drivers/net/netdevsim/health.c +++ b/drivers/net/netdevsim/health.c @@ -235,15 +235,10 @@ static ssize_t nsim_dev_health_break_write(struct file *file, char *break_msg; int err; - break_msg = kmalloc(count + 1, GFP_KERNEL); - if (!break_msg) - return -ENOMEM; + break_msg = memdup_user_nul(data, count); + if (IS_ERR(break_msg)) + return PTR_ERR(break_msg); - if (copy_from_user(break_msg, data, count)) { - err = -EFAULT; - goto out; - } - break_msg[count] = '\0'; if (break_msg[count - 1] == '\n') break_msg[count - 1] = '\0'; -- Gitee From 2f8bf378388c96a382f6d712aa354b15453a070d Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Sat, 14 Dec 2024 01:25:18 +0800 Subject: [PATCH 2/2] netdevsim: prevent bad user input in nsim_dev_health_break_write() ANBZ: #13096 commit 81bdfcd6e6a998e219c9dd49ec7291c2e0594bbc stable. commit ee76746387f6233bdfa93d7406990f923641568f upstream. If either a zero count or a large one is provided, kernel can crash. Fixes: 82c93a87bf8b ("netdevsim: implement couple of testing devlink health reporters") Reported-by: syzbot+ea40e4294e58b0292f74@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/675c6862.050a0220.37aaf.00b1.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: Jiri Pirko Reviewed-by: Joe Damato Link: https://patch.msgid.link/20241213172518.2415666-1-edumazet@google.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Fixes: CVE-2024-56716 Signed-off-by: Xiao Long Signed-off-by: Wen Gu --- drivers/net/netdevsim/health.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/netdevsim/health.c b/drivers/net/netdevsim/health.c index 04aebdf85747..c9306506b741 100644 --- a/drivers/net/netdevsim/health.c +++ b/drivers/net/netdevsim/health.c @@ -235,6 +235,8 @@ static ssize_t nsim_dev_health_break_write(struct file *file, char *break_msg; int err; + if (count == 0 || count > PAGE_SIZE) + return -EINVAL; break_msg = memdup_user_nul(data, count); if (IS_ERR(break_msg)) return PTR_ERR(break_msg); -- Gitee