Received-SPF: pass (google.com: domain of linux-kernel+bounces-131612-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Date: Thu, 4 Apr 2024 17:24:23 +0300
From: Dan Carpenter <dan.carpenter@linaro.org>
To: Alexander Lobakin <aleksander.lobakin@intel.com>
Cc: "David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	Yury Norov <yury.norov@gmail.com>,
	Alexander Potapenko <glider@google.com>,
	nex.sw.ncis.osdt.itp.upstreaming@intel.com,
	intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org,
	linux-kernel@vger.kernel.org, Simon Horman <horms@kernel.org>
Subject: Re: [PATCH net-next v6 15/21] ip_tunnel: use a separate struct to
 store tunnel params in the kernel
Message-ID: <5f63dd25-de94-4ca3-84e6-14095953db13@moroto.mountain>
References: <20240327152358.2368467-1-aleksander.lobakin@intel.com>
 <20240327152358.2368467-16-aleksander.lobakin@intel.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20240327152358.2368467-16-aleksander.lobakin@intel.com>

On Wed, Mar 27, 2024 at 04:23:52PM +0100, Alexander Lobakin wrote:
> +bool ip_tunnel_parm_to_user(void __user *data, struct ip_tunnel_parm_kern *kp)
> +{
> +	struct ip_tunnel_parm p;
> +
> +	strscpy(p.name, kp->name);

We need to clear out p before copying to user space to avoid an
information leak.  So this strscpy() needs to be strcpy_pad()

> +	p.link = kp->link;
> +	p.i_flags = kp->i_flags;
> +	p.o_flags = kp->o_flags;
> +	p.i_key = kp->i_key;
> +	p.o_key = kp->o_key;
> +	memcpy(&p.iph, &kp->iph, min(sizeof(p.iph), sizeof(kp->iph)));

And this memcpy() doesn't necessarily clear the whole of p.iph.

> +
> +	return !copy_to_user(data, &p, sizeof(p));
> +}

regards,
dan carpenter