diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-04-25 00:49:13 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-04-25 15:08:45 -0700 |
| commit | 2e5ed7fdfb23566cc3d85ce028b2f446c7bf057b (patch) | |
| tree | bba27ad4a740dbbf1799b567c93b771d1977f126 | |
| parent | cad7aa13a34dc83daa95ae5f9deca794021b4a2a (diff) | |
staging: lustre: improve length checks in ioctls
We copy "hdr->ioc_len" from the user twice but we only verify that it's
within the limit on the first copy. Otherwise we could read unmapped
memory and Oops.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Peng Tao <bergwolf@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/staging/lustre/lustre/libcfs/linux/linux-module.c | 4 | ||||
| -rw-r--r-- | drivers/staging/lustre/lustre/obdclass/linux/linux-module.c | 2 |
2 files changed, 6 insertions, 0 deletions
diff --git a/drivers/staging/lustre/lustre/libcfs/linux/linux-module.c b/drivers/staging/lustre/lustre/libcfs/linux/linux-module.c index e6eae0666f0d..9a3b07bd2fac 100644 --- a/drivers/staging/lustre/lustre/libcfs/linux/linux-module.c +++ b/drivers/staging/lustre/lustre/libcfs/linux/linux-module.c @@ -44,6 +44,7 @@ int libcfs_ioctl_getdata(char *buf, char *end, void *arg) { struct libcfs_ioctl_hdr *hdr; struct libcfs_ioctl_data *data; + int orig_len; int err; hdr = (struct libcfs_ioctl_hdr *)buf; @@ -69,9 +70,12 @@ int libcfs_ioctl_getdata(char *buf, char *end, void *arg) return -EINVAL; } + orig_len = hdr->ioc_len; err = copy_from_user(buf, (void *)arg, hdr->ioc_len); if (err) return err; + if (orig_len != data->ioc_len) + return -EINVAL; if (libcfs_ioctl_is_invalid(data)) { CERROR("PORTALS: ioctl not correctly formatted\n"); diff --git a/drivers/staging/lustre/lustre/obdclass/linux/linux-module.c b/drivers/staging/lustre/lustre/obdclass/linux/linux-module.c index e4e94cc1713d..dec10377f222 100644 --- a/drivers/staging/lustre/lustre/obdclass/linux/linux-module.c +++ b/drivers/staging/lustre/lustre/obdclass/linux/linux-module.c @@ -122,6 +122,8 @@ int obd_ioctl_getdata(char **buf, int *len, void *arg) OBD_FREE_LARGE(*buf, hdr.ioc_len); return err; } + if (hdr.ioc_len != data->ioc_len) + return -EINVAL; if (obd_ioctl_is_invalid(data)) { CERROR("ioctl not correctly formatted\n"); |