lkml.org 
[lkml]   [2016]   [Jan]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.13.y-ckt 030/108] staging: lustre: echo_copy.._lsm() dereferences userland pointers directly
    Date
    3.13.11-ckt33 -stable review patch.  If anyone has any objections, please let me know.

    ---8<------------------------------------------------------------

    From: Al Viro <viro@ZenIV.linux.org.uk>

    commit 9225c0b7b976dd9ceac2b80727a60d8fcb906a62 upstream.

    missing get_user()

    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [ luis: backported to 3.16: adjusted context ]
    Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    drivers/staging/lustre/lustre/obdecho/echo_client.c | 20 +++++++++++---------
    1 file changed, 11 insertions(+), 9 deletions(-)

    diff --git a/drivers/staging/lustre/lustre/obdecho/echo_client.c b/drivers/staging/lustre/lustre/obdecho/echo_client.c
    index 1fb0ac4..b5ba46c 100644
    --- a/drivers/staging/lustre/lustre/obdecho/echo_client.c
    +++ b/drivers/staging/lustre/lustre/obdecho/echo_client.c
    @@ -1381,6 +1381,7 @@ static int
    echo_copyout_lsm (struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob)
    {
    struct lov_stripe_md *ulsm = _ulsm;
    + struct lov_oinfo **p;
    int nob, i;

    nob = offsetof (struct lov_stripe_md, lsm_oinfo[lsm->lsm_stripe_count]);
    @@ -1390,9 +1391,10 @@ echo_copyout_lsm (struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob)
    if (copy_to_user (ulsm, lsm, sizeof(*ulsm)))
    return (-EFAULT);

    - for (i = 0; i < lsm->lsm_stripe_count; i++) {
    - if (copy_to_user (ulsm->lsm_oinfo[i], lsm->lsm_oinfo[i],
    - sizeof(lsm->lsm_oinfo[0])))
    + for (i = 0, p = lsm->lsm_oinfo; i < lsm->lsm_stripe_count; i++, p++) {
    + struct lov_oinfo __user *up;
    + if (get_user(up, ulsm->lsm_oinfo + i) ||
    + copy_to_user(up, *p, sizeof(struct lov_oinfo)))
    return (-EFAULT);
    }
    return 0;
    @@ -1400,9 +1402,10 @@ echo_copyout_lsm (struct lov_stripe_md *lsm, void *_ulsm, int ulsm_nob)

    static int
    echo_copyin_lsm (struct echo_device *ed, struct lov_stripe_md *lsm,
    - void *ulsm, int ulsm_nob)
    + struct lov_stripe_md __user *ulsm, int ulsm_nob)
    {
    struct echo_client_obd *ec = ed->ed_ec;
    + struct lov_oinfo **p;
    int i;

    if (ulsm_nob < sizeof (*lsm))
    @@ -1418,11 +1421,10 @@ echo_copyin_lsm (struct echo_device *ed, struct lov_stripe_md *lsm,
    return (-EINVAL);


    - for (i = 0; i < lsm->lsm_stripe_count; i++) {
    - if (copy_from_user(lsm->lsm_oinfo[i],
    - ((struct lov_stripe_md *)ulsm)-> \
    - lsm_oinfo[i],
    - sizeof(lsm->lsm_oinfo[0])))
    + for (i = 0, p = lsm->lsm_oinfo; i < lsm->lsm_stripe_count; i++, p++) {
    + struct lov_oinfo __user *up;
    + if (get_user(up, ulsm->lsm_oinfo + i) ||
    + copy_from_user(*p, up, sizeof(struct lov_oinfo)))
    return (-EFAULT);
    }
    return (0);
    --
    1.9.1
    \
     
     \ /
      Last update: 2016-01-23 01:41    [W:2.287 / U:0.160 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site