Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-3382-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Message-ID: <7cf0848b-f44c-42ad-848a-369a249bff77@gmail.com>
Date: Tue, 9 Apr 2024 15:07:41 +0200
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] net/socket: Ensure length of input socket option param >=
 sizeof(int)
To: Edward Adam Davis <eadavis@qq.com>, pmenzel@molgen.mpg.de,
 edumazet@google.com
Cc: netdev@vger.kernel.org, johan.hedberg@gmail.com,
 linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org,
 luiz.dentz@gmail.com, marcel@holtmann.org,
 syzbot+d4ecae01a53fd9b42e7d@syzkaller.appspotmail.com,
 syzkaller-bugs@googlegroups.com
References: <234da60a-709f-4430-b594-386b7c2b65f5@molgen.mpg.de>
 <tencent_15CA920ADD9ADDCA19654FBE8DB5A5B88D07@qq.com>
Content-Language: en-US
From: Eric Dumazet <eric.dumazet@gmail.com>
In-Reply-To: <tencent_15CA920ADD9ADDCA19654FBE8DB5A5B88D07@qq.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit


On 4/9/24 14:15, Edward Adam Davis wrote:
> The optlen value passed by syzbot to _sys_setsockopt() is 2, which results in
> only 2 bytes being allocated when allocating memory to kernel_optval, and the
> optval size passed when calling the function copy_from_sockptr() is 4 bytes.
> Here, optlen is determined uniformly in the entry function __sys_setsockopt().
> If its value is less than 4, the parameter is considered invalid.
>
> Reported-by: syzbot+837ba09d9db969068367@syzkaller.appspotmail.com
> Reported-by: syzbot+b71011ec0a23f4d15625@syzkaller.appspotmail.com
> Reported-by: syzbot+d4ecae01a53fd9b42e7d@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>


I think I gave my feedback already.

Please do not ignore maintainers feedback.

This patch is absolutely wrong.

Some setsockopt() deal with optlen == 1 just fine, thank you very much.