openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

staging: lustre: echo_copy.._lsm() dereferences userland pointers directly 

missing get_user()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Al Viro 2015-12-01 19:52:12 +00:00 committed by Greg Kroah-Hartman
parent cc4c60cc25
commit 9225c0b7b9
1 changed files with 11 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
drivers/staging/lustre/lustre/obdecho/echo_client.c
View File

@ -1270,6 +1270,7 @@ static int
echo_copyout_lsm(struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob) echo_copyout_lsm(struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob)
{ {
struct lov_stripe_md *ulsm = _ulsm; struct lov_stripe_md *ulsm = _ulsm;
struct lov_oinfo **p;
int nob, i; int nob, i;
nob = offsetof(struct lov_stripe_md, lsm_oinfo[lsm->lsm_stripe_count]); nob = offsetof(struct lov_stripe_md, lsm_oinfo[lsm->lsm_stripe_count]);
@ -1279,9 +1280,10 @@ echo_copyout_lsm(struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob)
if (copy_to_user(ulsm, lsm, sizeof(*ulsm))) if (copy_to_user(ulsm, lsm, sizeof(*ulsm)))
return -EFAULT; return -EFAULT;
for (i = 0; i < lsm->lsm_stripe_count; i++) { for (i = 0, p = lsm->lsm_oinfo; i < lsm->lsm_stripe_count; i++, p++) {
if (copy_to_user(ulsm->lsm_oinfo[i], lsm->lsm_oinfo[i], struct lov_oinfo __user *up;
sizeof(lsm->lsm_oinfo[0]))) if (get_user(up, ulsm->lsm_oinfo + i) ||
copy_to_user(up, *p, sizeof(struct lov_oinfo)))
return -EFAULT; return -EFAULT;
} }
return 0; return 0;
@ -1289,9 +1291,10 @@ echo_copyout_lsm(struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob)
static int static int
echo_copyin_lsm(struct echo_device *ed, struct lov_stripe_md *lsm, echo_copyin_lsm(struct echo_device *ed, struct lov_stripe_md *lsm,
void *ulsm, int ulsm_nob) struct lov_stripe_md __user *ulsm, int ulsm_nob)
{ {
struct echo_client_obd *ec = ed->ed_ec; struct echo_client_obd *ec = ed->ed_ec;
struct lov_oinfo **p;
int i; int i;
if (ulsm_nob < sizeof(*lsm)) if (ulsm_nob < sizeof(*lsm))
@ -1306,11 +1309,10 @@ echo_copyin_lsm(struct echo_device *ed, struct lov_stripe_md *lsm,
((__u64)lsm->lsm_stripe_size * lsm->lsm_stripe_count > ~0UL)) ((__u64)lsm->lsm_stripe_size * lsm->lsm_stripe_count > ~0UL))
return -EINVAL; return -EINVAL;
for (i = 0; i < lsm->lsm_stripe_count; i++) { for (i = 0, p = lsm->lsm_oinfo; i < lsm->lsm_stripe_count; i++, p++) {
if (copy_from_user(lsm->lsm_oinfo[i], struct lov_oinfo __user *up;
((struct lov_stripe_md *)ulsm)-> \ if (get_user(up, ulsm->lsm_oinfo + i) ||
lsm_oinfo[i], copy_from_user(*p, up, sizeof(struct lov_oinfo)))
sizeof(lsm->lsm_oinfo[0])))
return -EFAULT; return -EFAULT;
} }
return 0; return 0;