We must check the return value of the copy_from_sockptr. Otherwise, it
may cause some weird issues.
Fixes: 33f339a1ba54e ("bpf, net: Fix a potential race in do_sock_getsockopt()")
Signed-off-by: Qianqiang Liu <qianqiang.liu@163.com>
---
Changes from v1:
Add a fix tag
---
net/socket.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/socket.c b/net/socket.c
index 0a2bd22ec105..6b9a414d01d5 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2370,8 +2370,11 @@ int do_sock_getsockopt(struct socket *sock, bool compat, int level,
if (err)
return err;
- if (!compat)
- copy_from_sockptr(&max_optlen, optlen, sizeof(int));
+ if (!compat) {
+ err = copy_from_sockptr(&max_optlen, optlen, sizeof(int));
+ if (err)
+ return -EFAULT;
+ }
ops = READ_ONCE(sock->ops);
if (level == SOL_SOCKET) {
--
2.39.2