RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-10-31 16:12:44 +00:00
Code Issues Activity Actions

Kernel: Prevent inconsistent state after invalid read

Browse source 
copy_from_user can fail, for example when the user-supplied pointer is just before
the end of mapped address space. In that case, the first few bytes would get copied,
permanently overwriting the internal state of the Socket, potentially leaving it
in an inconsistent or at least difficult-to-predict state.
This commit is contained in:
Ben Wiederhake 2021-02-21 20:03:44 +01:00 • committed by Andreas Kling
parent b7c5d977c7
commit b374dd03bd
1 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
Kernel/Net/Socket.cpp
View file

@ -134,8 +134,12 @@ KResult Socket::setsockopt(int level, int option, Userspace<const void*> user_va
case SO_TIMESTAMP:
if (user_value_size != sizeof(int))
return EINVAL;
if (!copy_from_user(&m_timestamp, static_ptr_cast<const int*>(user_value)))
return EFAULT;
{
int timestamp;
if (!copy_from_user(&timestamp, static_ptr_cast<const int*>(user_value)))
return EFAULT;
m_timestamp = timestamp;
}
if (m_timestamp && (domain() != AF_INET || type() == SOCK_STREAM)) {
// FIXME: Support SO_TIMESTAMP for more protocols?
m_timestamp = 0;