Messages in this thread |  | | | Date | Fri, 2 Oct 2009 08:34:48 +1000 (EST) | | From | James Morris <> | | Subject | Re: [PATCH 7/9] Simplify bound checks in capabilities for copy_from_user |
| |
On Tue, 29 Sep 2009, Arjan van de Ven wrote:
> From: Arjan van de Ven <arjan@linux.intel.com> > Subject: [PATCH 7/9] Simplify bound checks in capabilities for copy_from_user > CC: James Morris <jmorris@namei.org> > > The capabilities syscall has a copy_from_user() call where gcc currently > cannot prove to itself that the copy is always within bounds. > > This patch adds a very explicity bound check to prove to gcc that > this copy_from_user cannot overflow its destination buffer. > > Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Acked-by: James Morris <jmorris@namei.org>
> diff --git a/kernel/capability.c b/kernel/capability.c > index 4e17041..204f11f 100644 > --- a/kernel/capability.c > +++ b/kernel/capability.c > @@ -238,7 +241,7 @@ SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr) > SYSCALL_DEFINE2(capset, cap_user_header_t, header, const cap_user_data_t, data) > { > struct __user_cap_data_struct kdata[_KERNEL_CAPABILITY_U32S]; > - unsigned i, tocopy; > + unsigned i, tocopy, copybytes; > kernel_cap_t inheritable, permitted, effective; > struct cred *new; > int ret; > @@ -255,8 +258,11 @@ SYSCALL_DEFINE2(capset, cap_user_header_t, header, const cap_user_data_t, data) > if (pid != 0 && pid != task_pid_vnr(current)) > return -EPERM; > > - if (copy_from_user(&kdata, data, > - tocopy * sizeof(struct __user_cap_data_struct))) > + copybytes = tocopy * sizeof(struct __user_cap_data_struct); > + if (copybytes > sizeof(kdata)) > + return -EFAULT; > + > + if (copy_from_user(&kdata, data, copybytes)) > return -EFAULT; > > for (i = 0; i < tocopy; i++) { > > > > -- > Arjan van de Ven Intel Open Source Technology Centre > For development, discussion and tips for power savings, > visit http://www.lesswatts.org >
-- James Morris <jmorris@namei.org>
|  |