summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEric Biggers <ebiggers@google.com>2019-12-04 21:54:19 -0800
committerDavid S. Miller <davem@davemloft.net>2019-12-05 14:45:19 -0800
commit0033b34a03ec5cf747cdaf9b1f9dceb91c020f17 (patch)
tree299f3f47c09c1e21245194204662b96bb73ef6a1
parenta116f4e238cc20dfbac30c65949752798f5b6efa (diff)
downloadlinux-next-0033b34a03ec5cf747cdaf9b1f9dceb91c020f17.tar.gz
ppp: fix out-of-bounds access in bpf_prog_create()
sock_fprog_kern::len is in units of struct sock_filter, not bytes. Fixes: 3e859adf3643 ("compat_ioctl: unify copy-in of ppp filters") Reported-by: syzbot+eb853b51b10f1befa0b7@syzkaller.appspotmail.com Signed-off-by: Eric Biggers <ebiggers@google.com> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--drivers/net/ppp/ppp_generic.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 0cb1c2d0a8bc..3bf8a8b42983 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -564,8 +564,9 @@ static struct bpf_prog *get_filter(struct sock_fprog *uprog)
return NULL;
/* uprog->len is unsigned short, so no overflow here */
- fprog.len = uprog->len * sizeof(struct sock_filter);
- fprog.filter = memdup_user(uprog->filter, fprog.len);
+ fprog.len = uprog->len;
+ fprog.filter = memdup_user(uprog->filter,
+ uprog->len * sizeof(struct sock_filter));
if (IS_ERR(fprog.filter))
return ERR_CAST(fprog.filter);