Date:   Mon, 10 Jan 2022 13:14:40 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Pavel Machek <pavel@denx.de>
Cc:     Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        linux-kernel@vger.kernel.org, stable@vger.kernel.org,
        Christoph Hellwig <hch@lst.de>,
        "David S. Miller" <davem@davemloft.net>
Subject: Re: [PATCH 5.10 09/43] netrom: fix copying in user data in
 nr_setsockopt
Message-ID: <20220110101439.GB1978@kadam>
References: <20220110071817.337619922@linuxfoundation.org>
 <20220110071817.669190550@linuxfoundation.org>
 <20220110100708.GA5588@duo.ucw.cz>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20220110100708.GA5588@duo.ucw.cz>
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?tNVtKiYSLdJFO+b9S1MlkEjXRg3Kex3uPcGM1UfCDC76P488HQGWI0vHJQjX?=
 =?us-ascii?Q?PGDQP6bqWqtTMVb5moLhA5/aU6Fd7pmwNbhkCmueoArsECJaTwlTA/Qe6xrM?=
 =?us-ascii?Q?xVfTW6H28x5Cu7+WY2b9SxmORFUTVr6OUChXyYbC+PbCvj3QJDEwVSI06WyE?=
 =?us-ascii?Q?VVTsy6yzX5rkdcssUhx+HRy59UzAdHCWhaTM09j1zsVJ3QhlsJutMdkIPl1A?=
 =?us-ascii?Q?KsHeIfAkz6W0Q+edlGJwl5mPq3QgHt8qwoqfKZpdTfKccmq3BOg6exnUf7B+?=
 =?us-ascii?Q?wcNM8Qg72MdEAnfYzUnXJFNWT0vJw/ts6jYl4qy26P7fQ8kMrIJHaRr1j9V6?=
 =?us-ascii?Q?lW0JQTKGVR9fbBCZiLUcfek3i2NEWRVMCe+tRNrv5cuMw84KCYcvvs6Bir/v?=
 =?us-ascii?Q?dbpRq3qez4OHaMlJxVaPseH6X5K21EM5XCYOV3Y/c9dOT+7tW8I8SWc8zwAS?=
 =?us-ascii?Q?DLQRSsxaMKsNZtxobQolf0a5GGoyl0XG9JE6VS8fh0oHps6aWHbKmA7Vh7Xg?=
 =?us-ascii?Q?VUTE6vV3z9OR2GejNgH3B7XQdgCXr8Mx/KOz8SZY7KNDumWDMg7CaOgiv96m?=
 =?us-ascii?Q?RfB6E0D6FB3QaGBmQYr5wv/zZIyj3xWba9vDgurS+dIyx0WB/4E35OCZemHg?=
 =?us-ascii?Q?vPGJTuI3pP42JGXBl8Hy45nxBGaIsUZp9RS4Dz9dtdOk/p6BAv6DU98gMdUI?=
 =?us-ascii?Q?t3nLsKS1EU1MNc9yRH0V516LaPL6FYqSyO/6A7E0oZTMbtBY3w+DqSs65LNc?=
 =?us-ascii?Q?O4AoDMyo6XMeqF4U+rrsjJSETD0RTT+1JoYd0hZzQKV+nxcyNaUhNGoulAQy?=
 =?us-ascii?Q?V/d5HGfg0+5fQ6qjyWRsOzGorAen2IaBF+8FTF/N9y5I2gtvPLyUsp4oildu?=
 =?us-ascii?Q?IZOjTSE/NaoAjnAE9TXaSqj8k6+prJHjmTgig7G7MBbLM2OPuaCfPOIG7YXM?=
 =?us-ascii?Q?iC8Sjv1Q8UspzYHUIZx5dG6M0agSsEySaqEw+afYX/EpZT+HUmVVIntWIu6O?=
 =?us-ascii?Q?bC+CTpPToe0m+VBsCFSUS1kt0t2xUX7icQh52XroxUFI018xyFCV9rAZi/8s?=
 =?us-ascii?Q?dNQ4Kw8vYe3fXHxen7jJ04fP7xCZynqcBKm6LGb/L1T/QO1jD9kCLD2VJis/?=
 =?us-ascii?Q?c9v/QHUMBUZdMAiai5iKXuM6FoDAg9ypAxX3c1Owrd9L4J5CerH80Z4lIMX8?=
 =?us-ascii?Q?JXjSJ5LVXELZNUMM7NJ08tW51gEHdrVbMygpbJCzZWRQTxUJVVX2mXrs3MOs?=
 =?us-ascii?Q?YMdemC139IAKaINkk5ulJPmfUjRGADWUSF+aF26Thd44johdYLWIee9Z/tKc?=
 =?us-ascii?Q?ywsoJuh/e3/xynVWhejXbS9rJp1MBfw/skrYARt21h38ljQEGsUyp6TOlJaq?=
 =?us-ascii?Q?CW30EkdQPFdxrsM99+FkDDCc1IRuQsPv4iNbe3dx6AB8ZYvPPRtsYxoX7rXm?=
 =?us-ascii?Q?fyFa3fVJJnxpusvmt0aDnI/hu1eazwoCXt1KhC4zNe/A2VQosI7XfKT1uGJl?=
 =?us-ascii?Q?6czB1CAo5L0CuMghuRZNhFRCj+Qt9TceCt3ots7TUHJaiNf+G1xnUARbqFGd?=
 =?us-ascii?Q?2HWYeu6FvxHkiID/bM7eG+BOKHqw/X/kXAv/FdoDiCl3Px18WHBzoZygoKqd?=
 =?us-ascii?Q?g3iCcvPrCVWqqXPWN70JWZbKLYZUFLbIvEMyQswxzpeJqC+ypfSG6rXfBAZ4?=
 =?us-ascii?Q?NmYbALjDnbfLMD2X744t5euITj8=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: af52872d-484c-4402-424d-08d9d422100c
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Jan 2022 10:15:01.8788
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: PEQ2/KNMysBK1ZJtFxACMhQYfZl1R2U51JSeXj7mD+6sVKk5HFA+OFHUS64msYSQEk4koOw//HRg+jvIM/bfHEL3UE/xL1Ko1x1GqT2Wsxs=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR10MB1360
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10222 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 bulkscore=0 spamscore=0
 phishscore=0 adultscore=0 suspectscore=0 mlxscore=0 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2201100072
X-Proofpoint-ORIG-GUID: C4vP1d9dR4TiVN_kBO5lRz_arQ9Niu_R
X-Proofpoint-GUID: C4vP1d9dR4TiVN_kBO5lRz_arQ9Niu_R
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Mon, Jan 10, 2022 at 11:07:08AM +0100, Pavel Machek wrote:
> Hi!
> 
> > From: Christoph Hellwig <hch@lst.de>
> > 
> > commit 3087a6f36ee028ec095c04a8531d7d33899b7fed upstream.
> > 
> > This code used to copy in an unsigned long worth of data before
> > the sockptr_t conversion, so restore that.
> 
> Maybe, but then	the size checks	need to	be updated, too.
> 
> > Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> > Signed-off-by: Christoph Hellwig <hch@lst.de>
> > Signed-off-by: David S. Miller <davem@davemloft.net>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > ---
> >  net/netrom/af_netrom.c |    2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > --- a/net/netrom/af_netrom.c
> > +++ b/net/netrom/af_netrom.c
> > @@ -306,7 +306,7 @@ static int nr_setsockopt(struct socket *
> >  	if (optlen < sizeof(unsigned int))
> 
> This should   be   < sizeof(unsigned long)) ... AFAICT.
> 
> >  		return -EINVAL;

Yeah.  This patch isn't right.  I sent a follow on that changes
everything to unsigned int.  Originally it was:

	if (get_user(opt, (unsigned int __user *)optval))

Which copies an unsigned int from the user into an unsigned long opt
variable.

My fix is required to fix an uninitialized data bug in a7b75c5a8c41
("net: pass a sockptr_t into ->setsockopt").  It would be sligthly more
complicated to just backport my fix without first backporting this one
and it would look sort of weird.  So I think it's better to backport
this and then mine.

regards,
dan carpenter