Commit e926095b authored by Jan Harkes's avatar Jan Harkes Committed by Linus Torvalds

[PATCH] coda: bounds checking

This patch adds bounds checks for tainted scalars (reported by Brian Fulton
and Ted Unangst, Coverity Inc.).
Signed-off-by: default avatarJan Harkes <jaharkes@cs.cmu.edu>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 019ae484
...@@ -555,6 +555,11 @@ int venus_pioctl(struct super_block *sb, struct CodaFid *fid, ...@@ -555,6 +555,11 @@ int venus_pioctl(struct super_block *sb, struct CodaFid *fid,
goto exit; goto exit;
} }
if (data->vi.out_size > VC_MAXDATASIZE) {
error = -EINVAL;
goto exit;
}
inp->coda_ioctl.VFid = *fid; inp->coda_ioctl.VFid = *fid;
/* the cmd field was mutated by increasing its size field to /* the cmd field was mutated by increasing its size field to
...@@ -583,19 +588,26 @@ int venus_pioctl(struct super_block *sb, struct CodaFid *fid, ...@@ -583,19 +588,26 @@ int venus_pioctl(struct super_block *sb, struct CodaFid *fid,
error, coda_f2s(fid)); error, coda_f2s(fid));
goto exit; goto exit;
} }
if (outsize < (long)outp->coda_ioctl.data + outp->coda_ioctl.len) {
error = -EINVAL;
goto exit;
}
/* Copy out the OUT buffer. */ /* Copy out the OUT buffer. */
if (outp->coda_ioctl.len > data->vi.out_size) { if (outp->coda_ioctl.len > data->vi.out_size) {
error = -EINVAL; error = -EINVAL;
} else { goto exit;
if (copy_to_user(data->vi.out,
(char *)outp + (long)outp->coda_ioctl.data,
data->vi.out_size)) {
error = -EFAULT;
goto exit;
}
} }
/* Copy out the OUT buffer. */
if (copy_to_user(data->vi.out,
(char *)outp + (long)outp->coda_ioctl.data,
outp->coda_ioctl.len)) {
error = -EFAULT;
goto exit;
}
exit: exit:
CODA_FREE(inp, insize); CODA_FREE(inp, insize);
return error; return error;
......
...@@ -761,8 +761,8 @@ union coda_downcalls { ...@@ -761,8 +761,8 @@ union coda_downcalls {
struct ViceIoctl { struct ViceIoctl {
void __user *in; /* Data to be transferred in */ void __user *in; /* Data to be transferred in */
void __user *out; /* Data to be transferred out */ void __user *out; /* Data to be transferred out */
short in_size; /* Size of input buffer <= 2K */ u_short in_size; /* Size of input buffer <= 2K */
short out_size; /* Maximum size of output buffer, <= 2K */ u_short out_size; /* Maximum size of output buffer, <= 2K */
}; };
struct PioctlData { struct PioctlData {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment