sctp: Copy struct sctp_sock.autoclose to userspace using put_user()

dwindsor · kees · commit b2ce04c2a336 · 2018-01-15T12:08:01.000-08:00
The autoclose field can be copied with put_user(), so there is no need to
use copy_to_user(). In both cases, hardened usercopy is being bypassed
since the size is constant, and not open to runtime manipulation.

This patch is verbatim from Brad Spengler/PaX Team's PAX_USERCOPY
whitelisting code in the last public patch of grsecurity/PaX based on my
understanding of the code. Changes or omissions from the original code are
mine and don't reflect the original grsecurity/PaX code.

Signed-off-by: David Windsor &lt;dave@nullcore.net&gt;
[kees: adjust commit log]
Cc: Vlad Yasevich &lt;vyasevich@gmail.com&gt;
Cc: Neil Horman &lt;nhorman@tuxdriver.com&gt;
Cc: "David S. Miller" &lt;davem@davemloft.net&gt;
Cc: linux-sctp@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook &lt;keescook@chromium.org&gt;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
@@ -5011,7 +5011,7 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
 	len = sizeof(int);
 	if (put_user(len, optlen))
 		return -EFAULT;
-	if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int)))
+	if (put_user(sctp_sk(sk)->autoclose, (int __user *)optval))
 		return -EFAULT;
 	return 0;
 }

Original file line number	Diff line number	Diff line change
`@@ -5011,7 +5011,7 @@ static int sctp_getsockopt_autoclose(struct sock sk, int len, char __user optv`
`5011`	`5011`	`len = sizeof(int);`
`5012`	`5012`	`if (put_user(len, optlen))`
`5013`	`5013`	`return -EFAULT;`
`5014`		`- if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int)))`
	`5014`	`+ if (put_user(sctp_sk(sk)->autoclose, (int __user *)optval))`
`5015`	`5015`	`return -EFAULT;`
`5016`	`5016`	`return 0;`
`5017`	`5017`	`}`