summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorGavrilov Ilia <Ilia.Gavrilov@infotecs.ru>2024-03-07 14:23:49 +0000
committerDavid S. Miller <davem@davemloft.net>2024-03-11 09:53:21 +0000
commit716edc9706deb3bb2ff56e2eeb83559cea8f22db (patch)
tree2b35dc61029fd5f9bd4dbe185b8bb51bde8ca3f3 /net
parentc2b25092864a16c7865e406badedece5cc25fc2b (diff)
tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function
The 'len' variable can't be negative when assigned the result of 'min_t' because all 'min_t' parameters are cast to unsigned int, and then the minimum one is chosen. To fix the logic, check 'len' as read from 'optlen', where the types of relevant variables are (signed) int. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru> Reviewed-by: Jason Xing <kerneljasonxing@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/ipv4/tcp.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index c5b83875411a..b091149742b1 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -4011,11 +4011,11 @@ int do_tcp_getsockopt(struct sock *sk, int level,
if (copy_from_sockptr(&len, optlen, sizeof(int)))
return -EFAULT;
- len = min_t(unsigned int, len, sizeof(int));
-
if (len < 0)
return -EINVAL;
+ len = min_t(unsigned int, len, sizeof(int));
+
switch (optname) {
case TCP_MAXSEG:
val = tp->mss_cache;