lkml.org 
[lkml]   [2003]   [May]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] Check copy_*_user return value in drivers/block/scsi_ioctl.c
Hi Jens,

Please find attached a trivial patch that checks both
copy_to_user() and copy_from_user() returns values in scsi_ioctl.c,
returning accordinly in case of a transfer error.

Please review.


Paulo Andre'



--- scsi_ioctl.c.orig 2003-05-25 16:42:22.000000000 +0100
+++ scsi_ioctl.c 2003-05-25 16:59:44.000000000 +0100
@@ -213,7 +213,8 @@

nr_sectors = bytes >> 9;
if (writing)
- copy_from_user(buffer,hdr.dxferp,hdr.dxfer_len);
+ if (copy_from_user(buffer,hdr.dxferp,hdr.dxfer_len))
+ goto efault;
else
memset(buffer, 0, hdr.dxfer_len);
}
@@ -225,7 +226,8 @@
* fill in request structure
*/
rq->cmd_len = hdr.cmd_len;
- copy_from_user(rq->cmd, hdr.cmdp, hdr.cmd_len);
+ if (copy_from_user(rq->cmd, hdr.cmdp, hdr.cmd_len))
+ goto efault;
if (sizeof(rq->cmd) != hdr.cmd_len)
memset(rq->cmd + hdr.cmd_len, 0, sizeof(rq->cmd) - hdr.cmd_len);

@@ -286,17 +288,23 @@

blk_put_request(rq);

- copy_to_user(uptr, &hdr, sizeof(*uptr));
+ if (copy_to_user(uptr, &hdr, sizeof(*uptr)))
+ goto efault;

if (buffer) {
if (reading)
- copy_to_user(hdr.dxferp, buffer, hdr.dxfer_len);
+ if (copy_to_user(hdr.dxferp, buffer, hdr.dxfer_len))
+ goto efault;

kfree(buffer);
}
/* may not have succeeded, but output values written to control
* structure (struct sg_io_hdr). */
return 0;
+efault:
+ if (buffer)
+ kfree(buffer);
+ return -EFAULT;
}

#define FORMAT_UNIT_TIMEOUT (2 * 60 * 60 * HZ)
\
 
 \ /
  Last update: 2005-03-22 13:35    [W:0.164 / U:0.080 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site