[PATCH] um: reject out-of-range port channel numbers

[PATCH] um: reject out-of-range port channel numbers

[Pengpeng Hou]

port_init() parses the port channel number into an int, formats it into
a small fixed string buffer, and later passes it to htons() for bind().
Out-of-range values can therefore overflow the local device-name buffer
and still get silently truncated at the socket layer.

Reject port numbers that do not fit in the 16-bit TCP/UDP port range.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 arch/um/drivers/port_user.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/arch/um/drivers/port_user.c b/arch/um/drivers/port_user.c
index 3c62ae81df62..b3d393811d69 100644
--- a/arch/um/drivers/port_user.c
+++ b/arch/um/drivers/port_user.c
@@ -19,7 +19,7 @@ struct port_chan {
 	int raw;
 	struct termios tt;
 	void *kernel_data;
-	char dev[sizeof("32768\0")];
+	char dev[sizeof("65535")];
 };
 
 static void *port_init(char *str, int device, const struct chan_opts *opts)
@@ -27,6 +27,7 @@ static void *port_init(char *str, int device, const struct chan_opts *opts)
 	struct port_chan *data;
 	void *kern_data;
 	char *end;
+	unsigned long parsed_port;
 	int port;
 
 	if (*str != ':') {
@@ -35,12 +36,13 @@ static void *port_init(char *str, int device, const struct chan_opts *opts)
 		return NULL;
 	}
 	str++;
-	port = strtoul(str, &end, 0);
-	if ((*end != '\0') || (end == str)) {
+	parsed_port = strtoul(str, &end, 0);
+	if ((*end != '\0') || end == str || parsed_port > 65535) {
 		printk(UM_KERN_ERR "port_init : couldn't parse port '%s'\n",
 		       str);
 		return NULL;
 	}
+	port = parsed_port;
 
 	kern_data = port_data(port);
 	if (kern_data == NULL)
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] um: reject out-of-range port channel numbers

[Johannes Berg]

On Thu, 2026-04-02 at 00:03 +0800, Pengpeng Hou wrote:
> port_init() parses the port channel number into an int, formats it into
> a small fixed string buffer, and later passes it to htons() for bind().
> Out-of-range values can therefore overflow the local device-name buffer
> and still get silently truncated at the socket layer.

So ... you have a whole bunch of these fixes, but do we really assume
that the kernel command-line is somehow attacker controlled for ARCH=um?

Maybe I'm not imagining the right things, but I have a hard time seeing
anyone run a service of any sort where the command line gets to be user-
controlled, and yet the kernel needs to be secure against that user; in
a normal ARCH=um scenario the command line is written by the user as
something like

	linux foo=bar mem=256M ...

and then can happily attach gdb to the process and muck with it any way
they want anyway?

I'd probably say the code shouldn't have been this way at the start, but
I'm also not convinced it's even really worth fixing for anything but
the "look my LLM found _something_" creds...

johannes

Re: [PATCH] um: reject out-of-range port channel numbers

[Anton Ivanov]

On 08/04/2026 08:39, Johannes Berg wrote:
> On Thu, 2026-04-02 at 00:03 +0800, Pengpeng Hou wrote:
>> port_init() parses the port channel number into an int, formats it into
>> a small fixed string buffer, and later passes it to htons() for bind().
>> Out-of-range values can therefore overflow the local device-name buffer
>> and still get silently truncated at the socket layer.
> So ... you have a whole bunch of these fixes, but do we really assume
> that the kernel command-line is somehow attacker controlled for ARCH=um?
>
> Maybe I'm not imagining the right things, but I have a hard time seeing
> anyone run a service of any sort where the command line gets to be user-
> controlled, and yet the kernel needs to be secure against that user; in
> a normal ARCH=um scenario the command line is written by the user as
> something like
>
> 	linux foo=bar mem=256M ...
>
> and then can happily attach gdb to the process and muck with it any way
> they want anyway?
>
> I'd probably say the code shouldn't have been this way at the start, but
> I'm also not convinced it's even really worth fixing for anything but
> the "look my LLM found _something_" creds...

+1

>
> johannes
>
-- 
Anton R. Ivanov
Cambridgegreys Limited. Registered in England. Company Number 10273661
https://www.cambridgegreys.com/

Re: [PATCH] um: reject out-of-range port channel numbers

[Pengpeng Hou]

Hi Johannes, Anton,

Thanks, that's fair.

I agree this is not a meaningful security boundary for UML, and I do not
have a strong enough use case to justify carrying this as a fix.

I'll drop this patch.

Thanks,
Pengpeng