Received: by 10.223.185.116 with SMTP id b49csp6363478wrg; Wed, 28 Feb 2018 08:12:00 -0800 (PST) X-Google-Smtp-Source: AH8x227Do0+cBEl/YVtyZFYcqu6B65s8CuDWXVPRmg9sJvUIhvDypnL8hEiVYWh7MbpY5yhGI1dU X-Received: by 2002:a17:902:9042:: with SMTP id w2-v6mr18227411plz.156.1519834320493; Wed, 28 Feb 2018 08:12:00 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519834320; cv=none; d=google.com; s=arc-20160816; b=SSvyS7chno6y8tQ1d8i5amRnJMp7pHC62QGCwXhhCDuyY4PW6w679EngffdMEEs862 iUiwxbYL6VzBO5BdI6OHw7Jd941crRLUA7EaTRMJNHHt9da/tplL4qmhuVkW/0hnHXg6 OrQdrfoGWXlWi0iUiWrol/TxqMl7eN+Dp+6HiNUNTCBmYzKOdvu4YhPte0mHUMQZhk5G sR0WbPkZr73ZpxF+lZbCb9Mhln32BhacWIkEmWr9aVdIjwT+g9D2UyZMM1IU+nlLt5vW lGl1iuvLMVGa6r90GVoDRuJV2S+OJtejjEYxwaa1dQvI8LT/WP/Wa+22/veWNKaG+gyw iS+g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:in-reply-to:subject:message-id:date:cc:to :from:mime-version:content-transfer-encoding:content-disposition :arc-authentication-results; bh=bsQueb7udiP+DxKbIQJ6oiJC2Efdl2GthSTaDf3Hq6k=; b=xku6tFbOmQ6bQa1Ak0PxiPNxykDCd83pqblETXCN9YbNiWjVbCRxE4ci/ZcR1KxfPZ M2tEsqZ7tlTSwmd8K98+5TpquSg83PxDIRss60FlOaci/V6F87vF6IvJrlQ7XSb0cPw4 6a1DOArbUp0yrKO+IPsvKkYlku4PYP6kDbEqMEyyMTMk71hXlLt90Ra20gwUXxWDtrpK b4rr1ZJ32/u0SZIpcdJsZ+WQnNPLsLsHhCLpSj4JctEi5U636Wt+J4SEQ0H3YO7pzWRH 9dVFb07zDHMJhdu548kAi3S2s4d+2AXqvw1a3fJcNuDoIbyLJFGaUJeKDCJKQ1XCPWHD TheA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id f132si1191745pgc.219.2018.02.28.08.11.45; Wed, 28 Feb 2018 08:12:00 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753135AbeB1QKD (ORCPT + 99 others); Wed, 28 Feb 2018 11:10:03 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:34978 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933089AbeB1QI6 (ORCPT ); Wed, 28 Feb 2018 11:08:58 -0500 Received: from [2a02:8011:400e:2:6f00:88c8:c921:d332] (helo=deadeye) by shadbolt.decadent.org.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1er3Yt-0006Xl-Ay; Wed, 28 Feb 2018 15:22:31 +0000 Received: from ben by deadeye with local (Exim 4.90_1) (envelope-from ) id 1er3Yf-0008VM-Md; Wed, 28 Feb 2018 15:22:17 +0000 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Herbert Xu" , "David S. Miller" Date: Wed, 28 Feb 2018 15:20:18 +0000 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.16 086/254] ipv4: Use standard iovec primitive in raw_probe_proto_opt In-Reply-To: X-SA-Exim-Connect-IP: 2a02:8011:400e:2:6f00:88c8:c921:d332 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.16.55-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Herbert Xu commit 32b5913a931fd753faf3d4e1124b2bc2edb364da upstream. The function raw_probe_proto_opt tries to extract the first two bytes from the user input in order to seed the IPsec lookup for ICMP packets. In doing so it's processing iovec by hand and overcomplicating things. This patch replaces the manual iovec processing with a call to memcpy_fromiovecend. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Ben Hutchings --- net/ipv4/raw.c | 50 +++++++++++--------------------------------------- 1 file changed, 11 insertions(+), 39 deletions(-) --- a/net/ipv4/raw.c +++ b/net/ipv4/raw.c @@ -417,48 +417,20 @@ error: static int raw_probe_proto_opt(struct flowi4 *fl4, struct msghdr *msg) { - struct iovec *iov; - u8 __user *type = NULL; - u8 __user *code = NULL; - int probed = 0; - unsigned int i; + struct icmphdr icmph; + int err; - if (!msg->msg_iov) + if (fl4->flowi4_proto != IPPROTO_ICMP) return 0; - for (i = 0; i < msg->msg_iovlen; i++) { - iov = &msg->msg_iov[i]; - if (!iov) - continue; - - switch (fl4->flowi4_proto) { - case IPPROTO_ICMP: - /* check if one-byte field is readable or not. */ - if (iov->iov_base && iov->iov_len < 1) - break; - - if (!type) { - type = iov->iov_base; - /* check if code field is readable or not. */ - if (iov->iov_len > 1) - code = type + 1; - } else if (!code) - code = iov->iov_base; - - if (type && code) { - if (get_user(fl4->fl4_icmp_type, type) || - get_user(fl4->fl4_icmp_code, code)) - return -EFAULT; - probed = 1; - } - break; - default: - probed = 1; - break; - } - if (probed) - break; - } + /* We only need the first two bytes. */ + err = memcpy_fromiovecend((void *)&icmph, msg->msg_iov, 0, 2); + if (err) + return err; + + fl4->fl4_icmp_type = icmph.type; + fl4->fl4_icmp_code = icmph.code; + return 0; }