evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

staging: lustre: improve length checks in ioctls

Browse source 
We copy "hdr->ioc_len" from the user twice but we only verify that it's
within the limit on the first copy.  Otherwise we could read unmapped
memory and Oops.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Peng Tao <bergwolf@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dan Carpenter 2014-04-25 00:49:13 +03:00 • committed by Greg Kroah-Hartman
parent cad7aa13a3
commit 2e5ed7fdfb
2 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
drivers/staging/lustre/lustre/libcfs/linux/linux-module.c
View file

@ -44,6 +44,7 @@ int libcfs_ioctl_getdata(char *buf, char *end, void *arg)
{ {
struct libcfs_ioctl_hdr *hdr; struct libcfs_ioctl_hdr *hdr;
struct libcfs_ioctl_data *data; struct libcfs_ioctl_data *data;
int orig_len;
int err; int err;
hdr = (struct libcfs_ioctl_hdr *)buf; hdr = (struct libcfs_ioctl_hdr *)buf;
@ -69,9 +70,12 @@ int libcfs_ioctl_getdata(char *buf, char *end, void *arg)
return -EINVAL; return -EINVAL;
} }
orig_len = hdr->ioc_len;
err = copy_from_user(buf, (void *)arg, hdr->ioc_len); err = copy_from_user(buf, (void *)arg, hdr->ioc_len);
if (err) if (err)
return err; return err;
if (orig_len != data->ioc_len)
return -EINVAL;
if (libcfs_ioctl_is_invalid(data)) { if (libcfs_ioctl_is_invalid(data)) {
CERROR("PORTALS: ioctl not correctly formatted\n"); CERROR("PORTALS: ioctl not correctly formatted\n");

2
drivers/staging/lustre/lustre/obdclass/linux/linux-module.c
View file

@ -122,6 +122,8 @@ int obd_ioctl_getdata(char **buf, int *len, void *arg)
OBD_FREE_LARGE(*buf, hdr.ioc_len); OBD_FREE_LARGE(*buf, hdr.ioc_len);
return err; return err;
} }
if (hdr.ioc_len != data->ioc_len)
return -EINVAL;
if (obd_ioctl_is_invalid(data)) { if (obd_ioctl_is_invalid(data)) {
CERROR("ioctl not correctly formatted\n"); CERROR("ioctl not correctly formatted\n");