diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2024-02-23 00:24:56 +0100 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2024-02-23 00:29:26 +0100 |
| commit | fecc51559a844b7f74119159c3cdb25b80b4e2c6 (patch) | |
| tree | 2cf1e49810eb0c58e552f722cc2ab2742e62cf43 /security/security.c | |
| parent | Merge tag 'wireless-next-2024-02-22' of git://git.kernel.org/pub/scm/linux/ke... (diff) | |
| parent | Merge tag 'net-6.8.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ne... (diff) | |
| download | linux-fecc51559a844b7f74119159c3cdb25b80b4e2c6.tar.xz linux-fecc51559a844b7f74119159c3cdb25b80b4e2c6.zip | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Cross-merge networking fixes after downstream PR.
Conflicts:
net/ipv4/udp.c
f796feabb9f5 ("udp: add local "peek offset enabled" flag")
56667da7399e ("net: implement lockless setsockopt(SO_PEEK_OFF)")
Adjacent changes:
net/unix/garbage.c
aa82ac51d633 ("af_unix: Drop oob_skb ref before purging queue in GC.")
11498715f266 ("af_unix: Remove io_uring code for GC.")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'security/security.c')
| -rw-r--r-- | security/security.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/security/security.c b/security/security.c index c41ad69a7f19..aef69632d0a9 100644 --- a/security/security.c +++ b/security/security.c @@ -29,6 +29,7 @@ #include <linux/backing-dev.h> #include <linux/string.h> #include <linux/msg.h> +#include <linux/overflow.h> #include <net/flow.h> /* How many LSMs were built into the kernel? */ @@ -4015,6 +4016,7 @@ int security_setselfattr(unsigned int attr, struct lsm_ctx __user *uctx, struct security_hook_list *hp; struct lsm_ctx *lctx; int rc = LSM_RET_DEFAULT(setselfattr); + u64 required_len; if (flags) return -EINVAL; @@ -4027,8 +4029,9 @@ int security_setselfattr(unsigned int attr, struct lsm_ctx __user *uctx, if (IS_ERR(lctx)) return PTR_ERR(lctx); - if (size < lctx->len || size < lctx->ctx_len + sizeof(*lctx) || - lctx->len < lctx->ctx_len + sizeof(*lctx)) { + if (size < lctx->len || + check_add_overflow(sizeof(*lctx), lctx->ctx_len, &required_len) || + lctx->len < required_len) { rc = -EINVAL; goto free_out; } |