lkml.org 
[lkml]   [2014]   [May]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.4 02/22] floppy: ignore kernel-only members in FDRAWCMD ioctl input
    Date
    3.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Matthew Daley <mattd@bugfuzz.com>

    commit ef87dbe7614341c2e7bfe8d32fcb7028cc97442c upstream.

    Always clear out these floppy_raw_cmd struct members after copying the
    entire structure from userspace so that the in-kernel version is always
    valid and never left in an interdeterminate state.

    Signed-off-by: Matthew Daley <mattd@bugfuzz.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/block/floppy.c | 6 +++---
    1 file changed, 3 insertions(+), 3 deletions(-)

    --- a/drivers/block/floppy.c
    +++ b/drivers/block/floppy.c
    @@ -3112,10 +3112,11 @@ loop:
    return -ENOMEM;
    *rcmd = ptr;
    ret = copy_from_user(ptr, param, sizeof(*ptr));
    - if (ret)
    - return -EFAULT;
    ptr->next = NULL;
    ptr->buffer_length = 0;
    + ptr->kernel_data = NULL;
    + if (ret)
    + return -EFAULT;
    param += sizeof(struct floppy_raw_cmd);
    if (ptr->cmd_count > 33)
    /* the command may now also take up the space
    @@ -3131,7 +3132,6 @@ loop:
    for (i = 0; i < 16; i++)
    ptr->reply[i] = 0;
    ptr->resultcode = 0;
    - ptr->kernel_data = NULL;

    if (ptr->flags & (FD_RAW_READ | FD_RAW_WRITE)) {
    if (ptr->length <= 0)



    \
     
     \ /
      Last update: 2014-05-11 23:21    [W:4.864 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site