From: Dan Carpenter <dan.carpenter@oracle.com>
To: Aditya Pakki <pakki001@umn.edu>
Cc: Arushi Singhal <arushisinghal19971997@gmail.com>,
devel@driverdev.osuosl.org,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
kjlu@umn.edu, linux-kernel@vger.kernel.org,
Mamta Shukla <mamtashukla555@gmail.com>,
Jia-Ju Bai <baijiaju1990@gmail.com>,
Nathan Chancellor <natechancellor@gmail.com>,
Quytelda Kahja <quytelda@tamalin.org>
Subject: Re: [PATCH] rtl8723bs/ioctl_linux: Add a security check to copy_from_user()
Date: Wed, 2 Jan 2019 12:10:16 +0300 [thread overview]
Message-ID: <20190102091016.GA3781@kadam> (raw)
In-Reply-To: <20181224001303.9032-1-pakki001@umn.edu>
On Sun, Dec 23, 2018 at 06:13:02PM -0600, Aditya Pakki wrote:
> diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
> index b8631baf128d..9992caa8c839 100644
> --- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
> +++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
> @@ -2577,14 +2577,19 @@ static int rtw_wps_start(struct net_device *dev,
> struct adapter *padapter = (struct adapter *)rtw_netdev_priv(dev);
> struct iw_point *pdata = &wrqu->data;
> u32 u32wps_start = 0;
> - unsigned int uintRet = 0;
>
> if ((true == padapter->bDriverStopped) ||(true ==padapter->bSurpriseRemoved) || (NULL == pdata)) {
> ret = -EINVAL;
> goto exit;
> }
>
> - uintRet = copy_from_user((void*)&u32wps_start, pdata->pointer, 4);
> + ret = copy_from_user((void *)&u32wps_start, pdata->pointer, 4);
> +
> + if (ret) {
> + ret = -EINVAL;
> + goto exit;
Good eye for spotting this bug. :)
Really this function is not useful though so we should just delete it.
All the CONFIG_INTEL_WIDI stuff is dead code.
Also if copy_from_user() the correct error code is -EFAULT. And we
would normally write it like this:
if (copy_from_user((void *)&u32wps_start, pdata->pointer, 4)) {
ret = -EFAULT;
goto exit;
}
But in this case, since this is dead code we should just delete
rtw_wps_start() and put a NULL in the rtw_private_handler[] array where
it used to be.
regards,
dan carpenter
prev parent reply other threads:[~2019-01-02 9:10 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-24 0:13 [PATCH] rtl8723bs/ioctl_linux: Add a security check to copy_from_user() Aditya Pakki
2019-01-02 9:10 ` Dan Carpenter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190102091016.GA3781@kadam \
--to=dan.carpenter@oracle.com \
--cc=arushisinghal19971997@gmail.com \
--cc=baijiaju1990@gmail.com \
--cc=devel@driverdev.osuosl.org \
--cc=gregkh@linuxfoundation.org \
--cc=kjlu@umn.edu \
--cc=linux-kernel@vger.kernel.org \
--cc=mamtashukla555@gmail.com \
--cc=natechancellor@gmail.com \
--cc=pakki001@umn.edu \
--cc=quytelda@tamalin.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.