diff options
| author | Peter Seiderer <ps.report@gmx.net> | 2025-02-19 09:45:27 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-06-04 14:40:12 +0200 |
| commit | ef1158a6a650ecee72ab40851b1d52e04d3f9cb5 (patch) | |
| tree | 6dbc5db34e66f99f9aef7dc57dbb9bc889236153 /net | |
| parent | 70a9888018196f475df04f06eeac20bac296a8c3 (diff) | |
| download | linux-ef1158a6a650ecee72ab40851b1d52e04d3f9cb5.tar.gz linux-ef1158a6a650ecee72ab40851b1d52e04d3f9cb5.tar.bz2 linux-ef1158a6a650ecee72ab40851b1d52e04d3f9cb5.zip | |
net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
[ Upstream commit 425e64440ad0a2f03bdaf04be0ae53dededbaa77 ]
Honour the user given buffer size for the strn_len() calls (otherwise
strn_len() will access memory outside of the user given buffer).
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250219084527.20488-8-ps.report@gmx.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/core/pktgen.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/net/core/pktgen.c b/net/core/pktgen.c index 5917820f92c3..a2838c15aa9d 100644 --- a/net/core/pktgen.c +++ b/net/core/pktgen.c @@ -1877,8 +1877,8 @@ static ssize_t pktgen_thread_write(struct file *file, i = len; /* Read variable name */ - - len = strn_len(&user_buffer[i], sizeof(name) - 1); + max = min(sizeof(name) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) return len; @@ -1908,7 +1908,8 @@ static ssize_t pktgen_thread_write(struct file *file, if (!strcmp(name, "add_device")) { char f[32]; memset(f, 0, 32); - len = strn_len(&user_buffer[i], sizeof(f) - 1); + max = min(sizeof(f) - 1, count - i); + len = strn_len(&user_buffer[i], max); if (len < 0) { ret = len; goto out; |