lkml.org 
[lkml]   [2003]   [Sep]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH 2.4] Fix bug in atm/he.c
Hi Marcelo,

Patch against 2.4.23-pre5.

Backport of the fix the Chas applied in 2.6 kernel.

If copy_from_user returns != 0, it means the the regs structure
wasn't filled correctly, and since its fields are used to determine
which ioctl the user is requesting the kernel could oops.

And as long as we're covering the subject, the patch also audits
copy_to_user on the same function to check a possible failure to copy
the result back to userspace.

These bugs were found by smatch.

Please consider applying.

Thanks,

Felipe
--- linux-2.4.23-pre5/drivers/atm/he.c.orig 2003-09-22 11:41:20.000000000 -0300
+++ linux-2.4.23-pre5/drivers/atm/he.c 2003-09-22 11:44:50.000000000 -0300
@@ -2866,8 +2866,10 @@
if (!capable(CAP_NET_ADMIN))
return -EPERM;

- copy_from_user(&reg, (struct he_ioctl_reg *) arg,
- sizeof(struct he_ioctl_reg));
+ if (copy_from_user(&reg, (struct he_ioctl_reg *) arg,
+ sizeof(struct he_ioctl_reg)))
+ return -EFAULT;
+
spin_lock_irqsave(&he_dev->global_lock, flags);
switch (reg.type) {
case HE_REGTYPE_PCI:
@@ -2891,8 +2893,9 @@
}
spin_unlock_irqrestore(&he_dev->global_lock, flags);
if (err == 0)
- copy_to_user((struct he_ioctl_reg *) arg, &reg,
- sizeof(struct he_ioctl_reg));
+ if (copy_to_user((struct he_ioctl_reg *) arg, &reg,
+ sizeof(struct he_ioctl_reg)))
+ return -EFAULT;
break;
default:
#ifdef CONFIG_ATM_HE_USE_SUNI
\
 
 \ /
  Last update: 2005-03-22 13:49    [W:0.022 / U:0.084 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site