Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2e5ed7fd authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

staging: lustre: improve length checks in ioctls 



We copy "hdr->ioc_len" from the user twice but we only verify that it's
within the limit on the first copy.  Otherwise we could read unmapped
memory and Oops.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarPeng Tao <bergwolf@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent cad7aa13

drivers/staging/lustre/lustre/libcfs/linux/linux-module.c

+4 −0
Original line number Original line Diff line number Diff line
@@ -44,6 +44,7 @@ int libcfs_ioctl_getdata(char *buf, char *end, void *arg) 
{

{

	struct libcfs_ioctl_hdr   *hdr;

	struct libcfs_ioctl_hdr   *hdr;

	struct libcfs_ioctl_data  *data;

	struct libcfs_ioctl_data  *data;

	int orig_len;

	int err;

	int err;





	hdr = (struct libcfs_ioctl_hdr *)buf;

	hdr = (struct libcfs_ioctl_hdr *)buf;
@@ -69,9 +70,12 @@ int libcfs_ioctl_getdata(char *buf, char *end, void *arg) 
		return -EINVAL;

		return -EINVAL;

	}

	}





	orig_len = hdr->ioc_len;

	err = copy_from_user(buf, (void *)arg, hdr->ioc_len);

	err = copy_from_user(buf, (void *)arg, hdr->ioc_len);

	if (err)

	if (err)

		return err;

		return err;

	if (orig_len != data->ioc_len)

		return -EINVAL;





	if (libcfs_ioctl_is_invalid(data)) {

	if (libcfs_ioctl_is_invalid(data)) {

		CERROR("PORTALS: ioctl not correctly formatted\n");

		CERROR("PORTALS: ioctl not correctly formatted\n");

drivers/staging/lustre/lustre/obdclass/linux/linux-module.c

+2 −0
Original line number Original line Diff line number Diff line
@@ -122,6 +122,8 @@ int obd_ioctl_getdata(char **buf, int *len, void *arg) 
		OBD_FREE_LARGE(*buf, hdr.ioc_len);

		OBD_FREE_LARGE(*buf, hdr.ioc_len);

		return err;

		return err;

	}

	}

	if (hdr.ioc_len != data->ioc_len)

		return -EINVAL;





	if (obd_ioctl_is_invalid(data)) {

	if (obd_ioctl_is_invalid(data)) {

		CERROR("ioctl not correctly formatted\n");

		CERROR("ioctl not correctly formatted\n");