Re: [PATCH net-next v3 08/10] net: pktgen: fix access outside of user given buffer in pktgen_if_write()

[Simon Horman]

On Mon, Feb 03, 2025 at 06:01:59PM +0100, Peter Seiderer wrote:
> Honour the user given buffer size for the hex32_arg(), num_arg(),
> strn_len(), get_imix_entries() and get_labels() calls (otherwise they will
> access memory outside of the user given buffer).
> 
> In hex32_arg(), num_arg(), strn_len() error out in case no characters are
> available (maxlen = 0), in num_arg() additional error out in case no valid
> character is parsed.
> 
> In get_labels() additional enable parsing labels up to MAX_IMIX_ENTRIES
> instead of (MAX_IMIX_ENTRIES - 1).
> 
> Additional remove some superfluous variable initializing and align some
> variable declarations to the most common pattern.
> 
> Signed-off-by: Peter Seiderer <ps.report@xxxxxxx>

...

> diff --git a/net/core/pktgen.c b/net/core/pktgen.c

...

> @@ -872,7 +886,8 @@ static ssize_t get_imix_entries(const char __user *buffer,
>  		if (size < 14 + 20 + 8)
>  			size = 14 + 20 + 8;
>  
> -		len = num_arg(&buffer[i], max_digits, &weight);
> +		max = min(10, maxlen - i);

Hi Peter,

10 is used as a magic value here. I think it would be best if
it were a #define so it has a name. Likewise for other constants
used as arguments to min() in this patch.

...