mirror of https://gitee.com/openkylin/linux.git
f9e3ebeea4
In _ctl_ioctl_main(), 'ioctl_header' is fetched the first time from userspace. 'ioctl_header.ioc_number' is then checked. The legal result is saved to 'ioc'. Then, in condition MPT3COMMAND, the whole struct is fetched again from the userspace. Then _ctl_do_mpt_command() is called, 'ioc' and 'karg' as inputs. However, a malicious user can change the 'ioc_number' between the two fetches, which will cause a potential security issues. Moreover, a malicious user can provide a valid 'ioc_number' to pass the check in first fetch, and then modify it in the second fetch. To fix this, we need to recheck the 'ioc_number' in the second fetch. Signed-off-by: Gen Zhang <blackgod016574@gmail.com> Acked-by: Suganath Prabu S <suganath-prabu.subramani@broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> |
||
|---|---|---|
| .. | ||
| mpi | ||
| Kconfig | ||
| Makefile | ||
| mpt3sas_base.c | ||
| mpt3sas_base.h | ||
| mpt3sas_config.c | ||
| mpt3sas_ctl.c | ||
| mpt3sas_ctl.h | ||
| mpt3sas_debug.h | ||
| mpt3sas_scsih.c | ||
| mpt3sas_transport.c | ||
| mpt3sas_trigger_diag.c | ||
| mpt3sas_trigger_diag.h | ||
| mpt3sas_warpdrive.c | ||