Commit 0033b34a authored Dec 04, 2019 by Eric Biggers Committed by David S. Miller Dec 05, 2019

ppp: fix out-of-bounds access in bpf_prog_create()



sock_fprog_kern::len is in units of struct sock_filter, not bytes.

Fixes: 3e859adf ("compat_ioctl: unify copy-in of ppp filters")
Reported-by:  <syzbot+eb853b51b10f1befa0b7@syzkaller.appspotmail.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent a116f4e2

drivers/net/ppp/ppp_generic.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -564,8 +564,9 @@ static struct bpf_prog get_filter(struct sock_fprog uprog)
		return NULL;

		/* uprog->len is unsigned short, so no overflow here */
		fprog.len = uprog->len * sizeof(struct sock_filter);
		fprog.filter = memdup_user(uprog->filter, fprog.len);
		fprog.len = uprog->len;
		fprog.filter = memdup_user(uprog->filter,
		uprog->len * sizeof(struct sock_filter));
		if (IS_ERR(fprog.filter))
		return ERR_CAST(fprog.filter);

Admin message