Messages in this thread Patch in this message |  | | Date | Sun, 25 May 2003 17:25:49 +0100 | From | Paulo Andre' <> | Subject | [PATCH] Check copy_*_user return value in drivers/block/scsi_ioctl.c |
| |
Hi Jens,
Please find attached a trivial patch that checks both copy_to_user() and copy_from_user() returns values in scsi_ioctl.c, returning accordinly in case of a transfer error.
Please review.
Paulo Andre'
--- scsi_ioctl.c.orig 2003-05-25 16:42:22.000000000 +0100 +++ scsi_ioctl.c 2003-05-25 16:59:44.000000000 +0100 @@ -213,7 +213,8 @@ nr_sectors = bytes >> 9; if (writing) - copy_from_user(buffer,hdr.dxferp,hdr.dxfer_len); + if (copy_from_user(buffer,hdr.dxferp,hdr.dxfer_len)) + goto efault; else memset(buffer, 0, hdr.dxfer_len); } @@ -225,7 +226,8 @@ * fill in request structure */ rq->cmd_len = hdr.cmd_len; - copy_from_user(rq->cmd, hdr.cmdp, hdr.cmd_len); + if (copy_from_user(rq->cmd, hdr.cmdp, hdr.cmd_len)) + goto efault; if (sizeof(rq->cmd) != hdr.cmd_len) memset(rq->cmd + hdr.cmd_len, 0, sizeof(rq->cmd) - hdr.cmd_len); @@ -286,17 +288,23 @@ blk_put_request(rq); - copy_to_user(uptr, &hdr, sizeof(*uptr)); + if (copy_to_user(uptr, &hdr, sizeof(*uptr))) + goto efault; if (buffer) { if (reading) - copy_to_user(hdr.dxferp, buffer, hdr.dxfer_len); + if (copy_to_user(hdr.dxferp, buffer, hdr.dxfer_len)) + goto efault; kfree(buffer); } /* may not have succeeded, but output values written to control * structure (struct sg_io_hdr). */ return 0; +efault: + if (buffer) + kfree(buffer); + return -EFAULT; } #define FORMAT_UNIT_TIMEOUT (2 * 60 * 60 * HZ) |  |