lkml.org 
[lkml]   [2009]   [Sep]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [PATCH] floppy: Add an extra bound check on ioctl arguments
On Wed, 30 Sep 2009 13:17:09 +0200
Arjan van de Ven <arjan@infradead.org> wrote:

>
> >From 90d75780b319153d050bb1c0f3f38ce054775615 Mon Sep 17 00:00:00 2001
> From: Arjan van de Ven <arjan@linux.intel.com>
> Date: Wed, 30 Sep 2009 13:13:59 +0200
> Subject: [PATCH] floppy: Add an extra bound check on ioctl arguments
>
> gcc is not convinced that the floppy.c ioctl has sufficient bound checks,
> and frankly, as a human I have a hard time proving the same more or less
> (the size comes from the ioctl argument. humpf. maybe. the code isn't
> very nice)
>
> This patch adds an explicit check to make 100% sure it's safe, better
> than finding out later that there indeed was a gap.
>
> Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
> ---
> drivers/block/floppy.c | 3 +++
> 1 files changed, 3 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
> index 5c01f74..0f11a77 100644
> --- a/drivers/block/floppy.c
> +++ b/drivers/block/floppy.c
> @@ -3497,6 +3497,9 @@ static int fd_ioctl(struct block_device *bdev, fmode_t mode, unsigned int cmd,
> ((cmd & 0x80) && !capable(CAP_SYS_ADMIN)))
> return -EPERM;
>
> + if (size < 0 || size > sizeof(inparam))
> + return -EINVAL;

I suspect that if this ever happens, normalize_ioctl() has
malfunctioned and what we have is a kernel bug.

This?

--- a/drivers/block/floppy.c~floppy-add-an-extra-bound-check-on-ioctl-arguments-fix
+++ a/drivers/block/floppy.c
@@ -3497,7 +3497,7 @@ static int fd_ioctl(struct block_device
((cmd & 0x80) && !capable(CAP_SYS_ADMIN)))
return -EPERM;

- if (size < 0 || size > sizeof(inparam))
+ if (WARN_ON(size < 0 || size > sizeof(inparam)))
return -EINVAL;

/* copyin */
_


\
 
 \ /
  Last update: 2009-10-01 01:19    [W:0.115 / U:0.288 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site