lkml.org 
[lkml]   [2018]   [Dec]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] hwtracing: stm: avoid a double-fetch case when fetching policy id
Date
"size" is fetched from user space and security checked. The fix avoids
fetching it again. Since "size" is no longer used after the second
fetch in the current code, so let's just skip copying "size" in the
second fetch.

Signed-off-by: Kangjie Lu <kjlu@umn.edu>
---
drivers/hwtracing/stm/core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index 93ce3aa740a9..55df1d374c57 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -752,7 +752,8 @@ static int stm_char_policy_set_ioctl(struct stm_file *stmf, void __user *arg)
if (!id)
return -ENOMEM;

- if (copy_from_user(id, arg, size)) {
+ if (copy_from_user(id + sizeof(size),
+ arg + sizeof(size), size - sizeof(size))) {
ret = -EFAULT;
goto err_free;
}
--
2.17.2 (Apple Git-113)
\
 
 \ /
  Last update: 2018-12-25 20:57    [W:0.034 / U:0.116 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site