Messages in this thread Patch in this message | | | Date | Fri, 7 Jan 2005 16:49:55 -0500 | Subject | [PATCH 2.4.29-pre3-bk4] fs/coda Re: [Coverity] Untrusted user data in kernel | From | Jan Harkes <> |
| |
This patch adds bounds checking for tainted scalars. (reported by Brian Fulton and Ted Unangst, Coverity Inc.)
Signed-off-by: Jan Harkes <jaharkes@cs.cmu.edu>
Index: linux-2.4.29-pre3-bk4/include/linux/coda.h =================================================================== --- linux-2.4.29-pre3-bk4.orig/include/linux/coda.h 2005-01-06 15:37:01.576583328 -0500 +++ linux-2.4.29-pre3-bk4/include/linux/coda.h 2005-01-06 09:12:40.000000000 -0500 @@ -767,8 +767,8 @@ #define PIOCPARM_MASK 0x0000ffff struct ViceIoctl { caddr_t in, out; /* Data to be transferred in, or out */ - short in_size; /* Size of input buffer <= 2K */ - short out_size; /* Maximum size of output buffer, <= 2K */ + u_short in_size; /* Size of input buffer <= 2K */ + u_short out_size; /* Maximum size of output buffer, <= 2K */ }; struct PioctlData { Index: linux-2.4.29-pre3-bk4/fs/coda/upcall.c =================================================================== --- linux-2.4.29-pre3-bk4.orig/fs/coda/upcall.c 2005-01-06 15:37:01.609578312 -0500 +++ linux-2.4.29-pre3-bk4/fs/coda/upcall.c 2005-01-06 15:36:24.849166744 -0500 @@ -543,6 +543,11 @@ goto exit; } + if (data->vi.out_size > VC_MAXDATASIZE) { + error = -EINVAL; + goto exit; + } + inp->coda_ioctl.VFid = *fid; /* the cmd field was mutated by increasing its size field to @@ -571,26 +576,30 @@ error, coda_f2s(fid)); goto exit; } - - /* Copy out the OUT buffer. */ + + if (outsize < (long)outp->coda_ioctl.data + outp->coda_ioctl.len) { + CDEBUG(D_FILE, "reply size %d < reply len %ld\n", outsize, + (long)outp->coda_ioctl.data + outp->coda_ioctl.len); + error = -EINVAL; + goto exit; + } + if (outp->coda_ioctl.len > data->vi.out_size) { - CDEBUG(D_FILE, "return len %d <= request len %d\n", - outp->coda_ioctl.len, - data->vi.out_size); + CDEBUG(D_FILE, "return len %d > request len %d\n", + outp->coda_ioctl.len, data->vi.out_size); error = -EINVAL; - } else { - error = verify_area(VERIFY_WRITE, data->vi.out, - data->vi.out_size); - if ( error ) goto exit; - - if (copy_to_user(data->vi.out, - (char *)outp + (long)outp->coda_ioctl.data, - data->vi.out_size)) { - error = -EINVAL; - goto exit; - } + goto exit; } + /* Copy out the OUT buffer. */ + error = verify_area(VERIFY_WRITE, data->vi.out, outp->coda_ioctl.len); + if ( error ) goto exit; + + if (copy_to_user(data->vi.out, + (char *)outp + (long)outp->coda_ioctl.data, + outp->coda_ioctl.len)) { + error = -EINVAL; + } exit: CODA_FREE(inp, insize); return error; - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |