All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 1/6] cifs: copy_to_user and copy_from_user fixes
@ 2005-01-15 13:25 Pekka Enberg
  2005-01-15 13:26 ` [PATCH 2/6] cifs: remove dead code Pekka Enberg
  0 siblings, 1 reply; 6+ messages in thread
From: Pekka Enberg @ 2005-01-15 13:25 UTC (permalink / raw)
  To: sfrench; +Cc: linux-kernel

Check return value for copy_to_user() and copy_from_user().

Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
---

 cifssmb.c |   37 ++++++++++++++++++++++---------------
 file.c    |    6 +++++-
 2 files changed, 27 insertions(+), 16 deletions(-)

Index: linux/fs/cifs/cifssmb.c
===================================================================
--- linux.orig/fs/cifs/cifssmb.c	2005-01-12 19:43:26.012611064 +0200
+++ linux/fs/cifs/cifssmb.c	2005-01-12 20:03:29.307682408 +0200
@@ -886,25 +886,29 @@
 	pSMB->Reserved = 0xFFFFFFFF;
 	pSMB->WriteMode = 0;
 	pSMB->Remaining = 0;
-	/* BB can relax this if buffer is big enough in some cases - ie we can 
-	send more  if LARGE_WRITE_X capability returned by the server and if
-	our buffer is big enough or if we convert to iovecs on socket writes
-	and eliminate the copy to the CIFS buffer */
+	/*
+	 * BB can relax this if buffer is big enough in some cases - ie we can 
+	 * send more  if LARGE_WRITE_X capability returned by the server and if
+	 * our buffer is big enough or if we convert to iovecs on socket writes
+	 * and eliminate the copy to the CIFS buffer
+	 */
 	bytes_sent = (tcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE) & ~0xFF;
 	if (bytes_sent > count)
 		bytes_sent = count;
 	pSMB->DataLengthHigh = 0;
 	pSMB->DataOffset =
 	    cpu_to_le16(offsetof(struct smb_com_write_req,Data) - 4);
-    if(buf)
-	    memcpy(pSMB->Data,buf,bytes_sent);
-	else if(ubuf)
-		copy_from_user(pSMB->Data,ubuf,bytes_sent);
-    else {
-		/* No buffer */
-		if(pSMB)
-			cifs_buf_release(pSMB);
-		return -EINVAL;
+
+	if (buf)
+		memcpy(pSMB->Data, buf, bytes_sent);
+	else if (ubuf) {
+		if (copy_from_user(pSMB->Data, ubuf, bytes_sent)) {
+			rc = -EFAULT;
+			goto out_release;
+		}
+	} else {
+		rc = -EINVAL;
+		goto out_release;
 	}
 
 	byte_count = bytes_sent + 1 /* pad */ ;
@@ -921,11 +925,14 @@
 	} else
 		*nbytes = le16_to_cpu(pSMBr->Count);
 
+ out_release:
 	if (pSMB)
 		cifs_buf_release(pSMB);
 
-	/* Note: On -EAGAIN error only caller can retry on handle based calls 
-		since file handle passed in no longer valid */
+	/*
+	 * Note: On -EAGAIN error only caller can retry on handle based calls
+	 * since file handle passed in no longer valid
+	 */
 
 	return rc;
 }
Index: linux/fs/cifs/file.c
===================================================================
--- linux.orig/fs/cifs/file.c	2005-01-12 19:43:26.018610152 +0200
+++ linux/fs/cifs/file.c	2005-01-12 20:02:29.110833720 +0200
@@ -1165,8 +1165,12 @@
 				 &bytes_read, &smb_read_data);
 
 			pSMBr = (struct smb_com_read_rsp *)smb_read_data;
-			copy_to_user(current_offset,smb_read_data + 4/* RFC1001 hdr*/
+			rc = copy_to_user(current_offset, smb_read_data + 4 /* RFC1001 hdr */
 				+ le16_to_cpu(pSMBr->DataOffset), bytes_read);
+			if (rc) {
+				FreeXid(xid);
+				return -EFAULT;
+			}
 			if(smb_read_data) {
 				cifs_buf_release(smb_read_data);
 				smb_read_data = NULL;



^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2005-01-15 13:42 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2005-01-15 13:25 [PATCH 1/6] cifs: copy_to_user and copy_from_user fixes Pekka Enberg
2005-01-15 13:26 ` [PATCH 2/6] cifs: remove dead code Pekka Enberg
2005-01-15 13:28   ` [PATCH 3/6] cifs: enum conversion Pekka Enberg
2005-01-15 13:29     ` [PATCH 4/6] cifs: remove spurious casts Pekka Enberg
2005-01-15 13:30       ` [PATCH 5/6] cifs: reduce deep nesting Pekka Enberg
2005-01-15 13:31         ` [PATCH 6/6] cifs: convert schedule_timeout to msleep and ssleep Pekka Enberg

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.