Messages in this thread Patch in this message | | | Date | Fri, 7 Jan 2005 16:54:00 -0500 | Subject | [PATCH 2.6.10-mm2] fs/coda Re: [Coverity] Untrusted user data in kernel | From | Jan Harkes <> |
| |
This patch adds bounds checks for tainted scalars (reported by Brian Fulton and Ted Unangst, Coverity Inc.).
Signed-off-by: Jan Harkes <jaharkes@cs.cmu.edu>
Index: linux-2.6.10-mm2/include/linux/coda.h =================================================================== --- linux-2.6.10-mm2.orig/include/linux/coda.h 2005-01-07 16:36:03.000000000 -0500 +++ linux-2.6.10-mm2/include/linux/coda.h 2005-01-07 16:42:20.000000000 -0500 @@ -761,8 +761,8 @@ struct ViceIoctl { void __user *in; /* Data to be transferred in */ void __user *out; /* Data to be transferred out */ - short in_size; /* Size of input buffer <= 2K */ - short out_size; /* Maximum size of output buffer, <= 2K */ + u_short in_size; /* Size of input buffer <= 2K */ + u_short out_size; /* Maximum size of output buffer, <= 2K */ }; struct PioctlData { Index: linux-2.6.10-mm2/fs/coda/upcall.c =================================================================== --- linux-2.6.10-mm2.orig/fs/coda/upcall.c 2005-01-07 16:36:03.000000000 -0500 +++ linux-2.6.10-mm2/fs/coda/upcall.c 2005-01-07 16:53:03.074276720 -0500 @@ -555,6 +555,11 @@ goto exit; } + if (data->vi.out_size > VC_MAXDATASIZE) { + error = -EINVAL; + goto exit; + } + inp->coda_ioctl.VFid = *fid; /* the cmd field was mutated by increasing its size field to @@ -583,19 +588,26 @@ error, coda_f2s(fid)); goto exit; } + + if (outsize < (long)outp->coda_ioctl.data + outp->coda_ioctl.len) { + error = -EINVAL; + goto exit; + } /* Copy out the OUT buffer. */ if (outp->coda_ioctl.len > data->vi.out_size) { error = -EINVAL; - } else { - if (copy_to_user(data->vi.out, - (char *)outp + (long)outp->coda_ioctl.data, - data->vi.out_size)) { - error = -EFAULT; - goto exit; - } + goto exit; } + /* Copy out the OUT buffer. */ + if (copy_to_user(data->vi.out, + (char *)outp + (long)outp->coda_ioctl.data, + outp->coda_ioctl.len)) { + error = -EFAULT; + goto exit; + } + exit: CODA_FREE(inp, insize); return error; - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |