p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

cw1200: Sanity-check arguments in copy_from_user() 

The optional debugfs interface to the vendor's engineering tools wasn't
bounds checking at all, which made it trivial to perform a buffer
overflow if this interface was compiled in and then explicitly enabled
at runtime.

This patch checks both the length supplied as part of the data to ensure
it is sane, and also the amount of data compared to the remaining buffer
space.  If either is too large, fail immediately.

(This bug was spotted by Dan Carpenter <dan.carpenter@oracle.com>)

Signed-off-by: Solomon Peachy <pizza@shaftnet.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Solomon Peachy 2013-06-04 23:37:05 -04:00 committed by John W. Linville
parent cc2588eabb
commit aa63e18e3d
1 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/net/wireless/cw1200/debug.c
View File

@ -397,13 +397,13 @@ struct etf_req_msg;
static int etf_request(struct cw1200_common *priv,
struct etf_req_msg *msg, u32 len);
#define MAX_RX_SZE 2600
#define MAX_RX_SIZE 2600
struct etf_in_state {
struct cw1200_common *priv;
u32 total_len;
u8 buf[MAX_RX_SZE];
u32 written;
u16 total_len;
u16 written;
u8 buf[MAX_RX_SIZE];
};
static int cw1200_etf_in_open(struct inode *inode, struct file *file)
@ -448,6 +448,11 @@ static ssize_t cw1200_etf_in_write(struct file *file,
return -EFAULT;
}
if (etf->total_len > MAX_RX_SIZE) {
pr_err("requested length > MAX_RX_SIZE\n");
return -EINVAL;
}
written += sizeof(etf->total_len);
count -= sizeof(etf->total_len);
}
@ -455,6 +460,11 @@ static ssize_t cw1200_etf_in_write(struct file *file,
if (!count)
goto done;
if (count > (etf->total_len - written)) {
pr_err("Tried to write > MAX_RX_SIZE\n");
return -EINVAL;
}
if (copy_from_user(etf->buf + etf->written, user_buf + written,
count)) {
pr_err("copy_from_user (payload %zu) failed\n", count);