Skip to content

Commit b374dd0

Browse files
BenWiederhakeawesomekling
authored andcommitted
Kernel: Prevent inconsistent state after invalid read
copy_from_user can fail, for example when the user-supplied pointer is just before the end of mapped address space. In that case, the first few bytes would get copied, permanently overwriting the internal state of the Socket, potentially leaving it in an inconsistent or at least difficult-to-predict state.
1 parent b7c5d97 commit b374dd0

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

Kernel/Net/Socket.cpp

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -134,8 +134,12 @@ KResult Socket::setsockopt(int level, int option, Userspace<const void*> user_va
134134
case SO_TIMESTAMP:
135135
if (user_value_size != sizeof(int))
136136
return EINVAL;
137-
if (!copy_from_user(&m_timestamp, static_ptr_cast<const int*>(user_value)))
138-
return EFAULT;
137+
{
138+
int timestamp;
139+
if (!copy_from_user(&timestamp, static_ptr_cast<const int*>(user_value)))
140+
return EFAULT;
141+
m_timestamp = timestamp;
142+
}
139143
if (m_timestamp && (domain() != AF_INET || type() == SOCK_STREAM)) {
140144
// FIXME: Support SO_TIMESTAMP for more protocols?
141145
m_timestamp = 0;

0 commit comments

Comments
 (0)