Messages in this thread Patch in this message | | | Date | Wed, 30 Sep 2009 16:16:03 -0700 | From | Andrew Morton <> | Subject | Re: [PATCH] floppy: Add an extra bound check on ioctl arguments |
| |
On Wed, 30 Sep 2009 13:17:09 +0200 Arjan van de Ven <arjan@infradead.org> wrote:
> > >From 90d75780b319153d050bb1c0f3f38ce054775615 Mon Sep 17 00:00:00 2001 > From: Arjan van de Ven <arjan@linux.intel.com> > Date: Wed, 30 Sep 2009 13:13:59 +0200 > Subject: [PATCH] floppy: Add an extra bound check on ioctl arguments > > gcc is not convinced that the floppy.c ioctl has sufficient bound checks, > and frankly, as a human I have a hard time proving the same more or less > (the size comes from the ioctl argument. humpf. maybe. the code isn't > very nice) > > This patch adds an explicit check to make 100% sure it's safe, better > than finding out later that there indeed was a gap. > > Signed-off-by: Arjan van de Ven <arjan@linux.intel.com> > --- > drivers/block/floppy.c | 3 +++ > 1 files changed, 3 insertions(+), 0 deletions(-) > > diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c > index 5c01f74..0f11a77 100644 > --- a/drivers/block/floppy.c > +++ b/drivers/block/floppy.c > @@ -3497,6 +3497,9 @@ static int fd_ioctl(struct block_device *bdev, fmode_t mode, unsigned int cmd, > ((cmd & 0x80) && !capable(CAP_SYS_ADMIN))) > return -EPERM; > > + if (size < 0 || size > sizeof(inparam)) > + return -EINVAL;
I suspect that if this ever happens, normalize_ioctl() has malfunctioned and what we have is a kernel bug.
This?
--- a/drivers/block/floppy.c~floppy-add-an-extra-bound-check-on-ioctl-arguments-fix +++ a/drivers/block/floppy.c @@ -3497,7 +3497,7 @@ static int fd_ioctl(struct block_device ((cmd & 0x80) && !capable(CAP_SYS_ADMIN))) return -EPERM; - if (size < 0 || size > sizeof(inparam)) + if (WARN_ON(size < 0 || size > sizeof(inparam))) return -EINVAL; /* copyin */ _
| |