kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

staging: lustre: libcfs: double copy bug

Browse source 
The problem is that we copy hdr.ioc_len, we verify it, then we copy it
again without checking to see if it has changed in between the two
copies.

This could result in an information leak.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dan Carpenter 2017-01-30 13:51:49 +03:00 committed by Greg Kroah-Hartman
parent dcdf43a01e
commit 76bdaa161c
1 changed files with 13 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
drivers/staging/lustre/lnet/libcfs/linux/linux-module.c
View file

@ -122,7 +122,7 @@ int libcfs_ioctl_getdata(struct libcfs_ioctl_hdr **hdr_pp,
const struct libcfs_ioctl_hdr __user *uhdr)
{
struct libcfs_ioctl_hdr hdr;
int err = 0;
int err;
if (copy_from_user(&hdr, uhdr, sizeof(hdr)))
return -EFAULT;
@ -150,9 +150,20 @@ int libcfs_ioctl_getdata(struct libcfs_ioctl_hdr **hdr_pp,
return -ENOMEM;
if (copy_from_user(*hdr_pp, uhdr, hdr.ioc_len)) {
LIBCFS_FREE(*hdr_pp, hdr.ioc_len);
err = -EFAULT;
goto free;
}
if ((*hdr_pp)->ioc_version != hdr.ioc_version ||
(*hdr_pp)->ioc_len != hdr.ioc_len) {
err = -EINVAL;
goto free;
}
return 0;
free:
LIBCFS_FREE(*hdr_pp, hdr.ioc_len);
return err;
}