Commit e926095b authored by Jan Harkes's avatar Jan Harkes Committed by Linus Torvalds

[PATCH] coda: bounds checking

This patch adds bounds checks for tainted scalars (reported by Brian Fulton
and Ted Unangst, Coverity Inc.).
Signed-off-by: default avatarJan Harkes <jaharkes@cs.cmu.edu>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 019ae484
......@@ -555,6 +555,11 @@ int venus_pioctl(struct super_block *sb, struct CodaFid *fid,
goto exit;
}
if (data->vi.out_size > VC_MAXDATASIZE) {
error = -EINVAL;
goto exit;
}
inp->coda_ioctl.VFid = *fid;
/* the cmd field was mutated by increasing its size field to
......@@ -584,17 +589,24 @@ int venus_pioctl(struct super_block *sb, struct CodaFid *fid,
goto exit;
}
if (outsize < (long)outp->coda_ioctl.data + outp->coda_ioctl.len) {
error = -EINVAL;
goto exit;
}
/* Copy out the OUT buffer. */
if (outp->coda_ioctl.len > data->vi.out_size) {
error = -EINVAL;
} else {
goto exit;
}
/* Copy out the OUT buffer. */
if (copy_to_user(data->vi.out,
(char *)outp + (long)outp->coda_ioctl.data,
data->vi.out_size)) {
outp->coda_ioctl.len)) {
error = -EFAULT;
goto exit;
}
}
exit:
CODA_FREE(inp, insize);
......
......@@ -761,8 +761,8 @@ union coda_downcalls {
struct ViceIoctl {
void __user *in; /* Data to be transferred in */
void __user *out; /* Data to be transferred out */
short in_size; /* Size of input buffer <= 2K */
short out_size; /* Maximum size of output buffer, <= 2K */
u_short in_size; /* Size of input buffer <= 2K */
u_short out_size; /* Maximum size of output buffer, <= 2K */
};
struct PioctlData {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment