* [PATCH] arch: sparc: kernel: check the memory length before use strcpy().
@ 2013-06-22 5:26 ` Chen Gang
0 siblings, 0 replies; 6+ messages in thread
From: Chen Gang @ 2013-06-22 5:26 UTC (permalink / raw)
To: Sam Ravnborg, zhaohongjiang
Cc: David Miller, Greg KH, sparclinux, linux-kernel@vger.kernel.org,
Linux-Arch
For the related next strcpy(), the destination length is less than 512,
but the source maximize length may be 'OPROMMAXPARAM' (4096) which is
more than 512.
One work flow may:
openprom_sunos_ioctl() -> if (cmd == OPROMSETOPT)
getstrings() -> will alloc buffer with size 'OPROMMAXPARAM'.
opromsetopt() -> devide the buffer into 'var' and 'value'
of_set_property() -> pass
prom_setprop() -> pass
ldom_set_var()
And do not mind the additional 4 alignment buffer increasing, since
'sizeof(pkt) - sizeof(pkt.header)' is 4 alignment at least.
Signed-off-by: Chen Gang <gang.chen@asianux.com>
---
arch/sparc/kernel/ds.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
index 5ef48da..11d460f 100644
--- a/arch/sparc/kernel/ds.c
+++ b/arch/sparc/kernel/ds.c
@@ -783,6 +783,16 @@ void ldom_set_var(const char *var, const char *value)
char *base, *p;
int msg_len, loops;
+ if (strlen(var) + strlen(value) + 2 >
+ sizeof(pkt) - sizeof(pkt.header)) {
+ printk(KERN_ERR PFX
+ "contents length: %zu, which more than max: %lu,"
+ "so could not set (%s) variable to (%s).\n",
+ strlen(var) + strlen(value) + 2,
+ sizeof(pkt) - sizeof(pkt.header), var, value);
+ return;
+ }
+
memset(&pkt, 0, sizeof(pkt));
pkt.header.data.tag.type = DS_DATA;
pkt.header.data.handle = cp->handle;
--
1.7.11.7
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH] arch: sparc: kernel: check the memory length before use strcpy().
@ 2013-06-22 5:26 ` Chen Gang
0 siblings, 0 replies; 6+ messages in thread
From: Chen Gang @ 2013-06-22 5:26 UTC (permalink / raw)
To: Sam Ravnborg, zhaohongjiang
Cc: David Miller, Greg KH, sparclinux, linux-kernel@vger.kernel.org,
Linux-Arch
For the related next strcpy(), the destination length is less than 512,
but the source maximize length may be 'OPROMMAXPARAM' (4096) which is
more than 512.
One work flow may:
openprom_sunos_ioctl() -> if (cmd = OPROMSETOPT)
getstrings() -> will alloc buffer with size 'OPROMMAXPARAM'.
opromsetopt() -> devide the buffer into 'var' and 'value'
of_set_property() -> pass
prom_setprop() -> pass
ldom_set_var()
And do not mind the additional 4 alignment buffer increasing, since
'sizeof(pkt) - sizeof(pkt.header)' is 4 alignment at least.
Signed-off-by: Chen Gang <gang.chen@asianux.com>
---
arch/sparc/kernel/ds.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
index 5ef48da..11d460f 100644
--- a/arch/sparc/kernel/ds.c
+++ b/arch/sparc/kernel/ds.c
@@ -783,6 +783,16 @@ void ldom_set_var(const char *var, const char *value)
char *base, *p;
int msg_len, loops;
+ if (strlen(var) + strlen(value) + 2 >
+ sizeof(pkt) - sizeof(pkt.header)) {
+ printk(KERN_ERR PFX
+ "contents length: %zu, which more than max: %lu,"
+ "so could not set (%s) variable to (%s).\n",
+ strlen(var) + strlen(value) + 2,
+ sizeof(pkt) - sizeof(pkt.header), var, value);
+ return;
+ }
+
memset(&pkt, 0, sizeof(pkt));
pkt.header.data.tag.type = DS_DATA;
pkt.header.data.handle = cp->handle;
--
1.7.11.7
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] arch: sparc: kernel: check the memory length before use strcpy().
2013-06-22 5:26 ` Chen Gang
@ 2013-07-10 20:42 ` David Miller
-1 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2013-07-10 20:42 UTC (permalink / raw)
To: gang.chen
Cc: sam, zhaohongjiang, gregkh, sparclinux, linux-kernel, linux-arch
From: Chen Gang <gang.chen@asianux.com>
Date: Sat, 22 Jun 2013 13:26:09 +0800
>
> For the related next strcpy(), the destination length is less than 512,
> but the source maximize length may be 'OPROMMAXPARAM' (4096) which is
> more than 512.
>
> One work flow may:
> openprom_sunos_ioctl() -> if (cmd == OPROMSETOPT)
> getstrings() -> will alloc buffer with size 'OPROMMAXPARAM'.
> opromsetopt() -> devide the buffer into 'var' and 'value'
> of_set_property() -> pass
> prom_setprop() -> pass
> ldom_set_var()
>
> And do not mind the additional 4 alignment buffer increasing, since
> 'sizeof(pkt) - sizeof(pkt.header)' is 4 alignment at least.
>
>
> Signed-off-by: Chen Gang <gang.chen@asianux.com>
Applied.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] arch: sparc: kernel: check the memory length before use strcpy().
@ 2013-07-10 20:42 ` David Miller
0 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2013-07-10 20:42 UTC (permalink / raw)
To: gang.chen
Cc: sam, zhaohongjiang, gregkh, sparclinux, linux-kernel, linux-arch
From: Chen Gang <gang.chen@asianux.com>
Date: Sat, 22 Jun 2013 13:26:09 +0800
>
> For the related next strcpy(), the destination length is less than 512,
> but the source maximize length may be 'OPROMMAXPARAM' (4096) which is
> more than 512.
>
> One work flow may:
> openprom_sunos_ioctl() -> if (cmd = OPROMSETOPT)
> getstrings() -> will alloc buffer with size 'OPROMMAXPARAM'.
> opromsetopt() -> devide the buffer into 'var' and 'value'
> of_set_property() -> pass
> prom_setprop() -> pass
> ldom_set_var()
>
> And do not mind the additional 4 alignment buffer increasing, since
> 'sizeof(pkt) - sizeof(pkt.header)' is 4 alignment at least.
>
>
> Signed-off-by: Chen Gang <gang.chen@asianux.com>
Applied.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] arch: sparc: kernel: check the memory length before use strcpy().
2013-07-10 20:42 ` David Miller
@ 2013-07-10 23:41 ` Chen Gang
-1 siblings, 0 replies; 6+ messages in thread
From: Chen Gang @ 2013-07-10 23:41 UTC (permalink / raw)
To: David Miller
Cc: sam, zhaohongjiang, gregkh, sparclinux, linux-kernel, linux-arch
On 07/11/2013 04:42 AM, David Miller wrote:
> From: Chen Gang <gang.chen@asianux.com>
> Date: Sat, 22 Jun 2013 13:26:09 +0800
>
>> >
>> > For the related next strcpy(), the destination length is less than 512,
>> > but the source maximize length may be 'OPROMMAXPARAM' (4096) which is
>> > more than 512.
>> >
>> > One work flow may:
>> > openprom_sunos_ioctl() -> if (cmd == OPROMSETOPT)
>> > getstrings() -> will alloc buffer with size 'OPROMMAXPARAM'.
>> > opromsetopt() -> devide the buffer into 'var' and 'value'
>> > of_set_property() -> pass
>> > prom_setprop() -> pass
>> > ldom_set_var()
>> >
>> > And do not mind the additional 4 alignment buffer increasing, since
>> > 'sizeof(pkt) - sizeof(pkt.header)' is 4 alignment at least.
>> >
>> >
>> > Signed-off-by: Chen Gang <gang.chen@asianux.com>
> Applied.
>
>
Thank you for your work, especially you are very busy.
--
Chen Gang
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] arch: sparc: kernel: check the memory length before use strcpy().
@ 2013-07-10 23:41 ` Chen Gang
0 siblings, 0 replies; 6+ messages in thread
From: Chen Gang @ 2013-07-10 23:41 UTC (permalink / raw)
To: David Miller
Cc: sam, zhaohongjiang, gregkh, sparclinux, linux-kernel, linux-arch
On 07/11/2013 04:42 AM, David Miller wrote:
> From: Chen Gang <gang.chen@asianux.com>
> Date: Sat, 22 Jun 2013 13:26:09 +0800
>
>> >
>> > For the related next strcpy(), the destination length is less than 512,
>> > but the source maximize length may be 'OPROMMAXPARAM' (4096) which is
>> > more than 512.
>> >
>> > One work flow may:
>> > openprom_sunos_ioctl() -> if (cmd = OPROMSETOPT)
>> > getstrings() -> will alloc buffer with size 'OPROMMAXPARAM'.
>> > opromsetopt() -> devide the buffer into 'var' and 'value'
>> > of_set_property() -> pass
>> > prom_setprop() -> pass
>> > ldom_set_var()
>> >
>> > And do not mind the additional 4 alignment buffer increasing, since
>> > 'sizeof(pkt) - sizeof(pkt.header)' is 4 alignment at least.
>> >
>> >
>> > Signed-off-by: Chen Gang <gang.chen@asianux.com>
> Applied.
>
>
Thank you for your work, especially you are very busy.
--
Chen Gang
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2013-07-10 23:41 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-06-22 5:26 [PATCH] arch: sparc: kernel: check the memory length before use strcpy() Chen Gang
2013-06-22 5:26 ` Chen Gang
2013-07-10 20:42 ` David Miller
2013-07-10 20:42 ` David Miller
2013-07-10 23:41 ` Chen Gang
2013-07-10 23:41 ` Chen Gang
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.