Skip to content

Commit b98b0bc

Browse files
Eric Dumazetdavem330
Eric Dumazet
authored andcommitted
net: avoid signed overflows for SO_{SND|RCV}BUFFORCE
CAP_NET_ADMIN users should not be allowed to set negative sk_sndbuf or sk_rcvbuf values, as it can lead to various memory corruptions, crashes, OOM... Note that before commit 8298193 ("net: cleanups in sock_setsockopt()"), the bug was even more serious, since SO_SNDBUF and SO_RCVBUF were vulnerable. This needs to be backported to all known linux kernels. Again, many thanks to syzkaller team for discovering this gem. Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 5b01014 commit b98b0bc

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

Diff for: net/core/sock.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -715,7 +715,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
715715
val = min_t(u32, val, sysctl_wmem_max);
716716
set_sndbuf:
717717
sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
718-
sk->sk_sndbuf = max_t(u32, val * 2, SOCK_MIN_SNDBUF);
718+
sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF);
719719
/* Wake up sending tasks if we upped the value. */
720720
sk->sk_write_space(sk);
721721
break;
@@ -751,7 +751,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
751751
* returning the value we actually used in getsockopt
752752
* is the most desirable behavior.
753753
*/
754-
sk->sk_rcvbuf = max_t(u32, val * 2, SOCK_MIN_RCVBUF);
754+
sk->sk_rcvbuf = max_t(int, val * 2, SOCK_MIN_RCVBUF);
755755
break;
756756

757757
case SO_RCVBUFFORCE:

0 commit comments

Comments
 (0)