Re: [PATCH net-next v2 1/6] tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function

[Jason Xing]

On Thu, Mar 7, 2024 at 10:44 PM Gavrilov Ilia <Ilia.Gavrilov@xxxxxxxxxxx> wrote:
>
> The 'len' variable can't be negative when assigned the result of
> 'min_t' because all 'min_t' parameters are cast to unsigned int,
> and then the minimum one is chosen.
>
> To fix the logic, check 'len' as read from 'optlen',
> where the types of relevant variables are (signed) int.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@xxxxxxxxxxx>

For the patch itself, please feel free to add:
Reviewed-by: Jason Xing <kerneljasonxing@xxxxxxxxx>

I notice that you use Fixes meanwhile you target net-next. I'm not
sure if it's proper.

> ---
> V2:
>  - reword the patch description
>
>  net/ipv4/tcp.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> index c82dc42f57c6..a4f418592314 100644
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ -4010,11 +4010,11 @@ int do_tcp_getsockopt(struct sock *sk, int level,
>         if (copy_from_sockptr(&len, optlen, sizeof(int)))
>                 return -EFAULT;
>
> -       len = min_t(unsigned int, len, sizeof(int));
> -
>         if (len < 0)
>                 return -EINVAL;
>
> +       len = min_t(unsigned int, len, sizeof(int));
> +
>         switch (optname) {
>         case TCP_MAXSEG:
>                 val = tp->mss_cache;
> --
> 2.39.2
>