lkml.org 
[lkml]   [2019]   [Jun]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 17/45] mISDN: make sure device name is NUL terminated
    Date
    [ Upstream commit ccfb62f27beb295103e9392462b20a6ed807d0ea ]

    The user can change the device_name with the IMSETDEVNAME ioctl, but we
    need to ensure that the user's name is NUL terminated. Otherwise it
    could result in a buffer overflow when we copy the name back to the user
    with IMGETDEVINFO ioctl.

    I also changed two strcpy() calls which handle the name to strscpy().
    Hopefully, there aren't any other ways to create a too long name, but
    it's nice to do this as a kernel hardening measure.

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/isdn/mISDN/socket.c | 5 +++--
    1 file changed, 3 insertions(+), 2 deletions(-)

    diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
    index 65cb4aac8dce..477e07036add 100644
    --- a/drivers/isdn/mISDN/socket.c
    +++ b/drivers/isdn/mISDN/socket.c
    @@ -394,7 +394,7 @@ data_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
    memcpy(di.channelmap, dev->channelmap,
    sizeof(di.channelmap));
    di.nrbchan = dev->nrbchan;
    - strcpy(di.name, dev_name(&dev->dev));
    + strscpy(di.name, dev_name(&dev->dev), sizeof(di.name));
    if (copy_to_user((void __user *)arg, &di, sizeof(di)))
    err = -EFAULT;
    } else
    @@ -678,7 +678,7 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
    memcpy(di.channelmap, dev->channelmap,
    sizeof(di.channelmap));
    di.nrbchan = dev->nrbchan;
    - strcpy(di.name, dev_name(&dev->dev));
    + strscpy(di.name, dev_name(&dev->dev), sizeof(di.name));
    if (copy_to_user((void __user *)arg, &di, sizeof(di)))
    err = -EFAULT;
    } else
    @@ -692,6 +692,7 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
    err = -EFAULT;
    break;
    }
    + dn.name[sizeof(dn.name) - 1] = '\0';
    dev = get_mdevice(dn.id);
    if (dev)
    err = device_rename(&dev->dev, dn.name);
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-06-20 20:09    [W:4.451 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site