lkml.org 
[lkml]   [2003]   [Oct]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] Using possibly corrupted structures in sjcd CDROM driver
	Hi Andrew/Vadim,

Patch against 2.6.0-test6.

Check the return of copy_from_user in a few places to not use buggy
structures if copy_from_user != 0. Found by smatch.

Please consider applying,

Thanks.

Felipe
--- linux-2.6.0-test6/drivers/cdrom/sjcd.c.orig 2003-10-06 10:35:54.000000000 -0300
+++ linux-2.6.0-test6/drivers/cdrom/sjcd.c 2003-10-06 10:38:43.000000000 -0300
@@ -842,8 +842,9 @@
CDROM_AUDIO_NO_STATUS;
}

- copy_from_user(&sjcd_msf, (void *) arg,
- sizeof(sjcd_msf));
+ if (copy_from_user(&sjcd_msf, (void *) arg,
+ sizeof(sjcd_msf)))
+ return (-EFAULT);

sjcd_playing.start.min =
bin2bcd(sjcd_msf.cdmsf_min0);
@@ -893,9 +894,9 @@
sizeof(toc_entry))) == 0) {
struct sjcd_hw_disk_info *tp;

- copy_from_user(&toc_entry, (void *) arg,
- sizeof(toc_entry));
-
+ if (copy_from_user(&toc_entry, (void *) arg,
+ sizeof(toc_entry)))
+ return (-EFAULT);
if (toc_entry.cdte_track == CDROM_LEADOUT)
tp = &sjcd_table_of_contents[0];
else if (toc_entry.cdte_track <
@@ -948,8 +949,10 @@
sizeof(subchnl))) == 0) {
struct sjcd_hw_qinfo q_info;

- copy_from_user(&subchnl, (void *) arg,
- sizeof(subchnl));
+ if (copy_from_user(&subchnl, (void *) arg,
+ sizeof(subchnl)))
+ return (-EFAULT);
+
if (sjcd_get_q_info(&q_info) < 0)
return (-EIO);

@@ -1005,8 +1008,9 @@
sizeof(vol_ctrl))) == 0) {
unsigned char dummy[4];

- copy_from_user(&vol_ctrl, (void *) arg,
- sizeof(vol_ctrl));
+ if (copy_from_user(&vol_ctrl, (void *) arg,
+ sizeof(vol_ctrl)))
+ return (-EFAULT);
sjcd_send_4_cmd(SCMD_SET_VOLUME,
vol_ctrl.channel0, 0xFF,
vol_ctrl.channel1, 0xFF);
\
 
 \ /
  Last update: 2005-03-22 13:49    [W:0.052 / U:0.080 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site