* [patch] Staging: sep: potential buffer overflow in ioctl
@ 2011-10-29 7:20 Dan Carpenter
0 siblings, 0 replies; 2+ messages in thread
From: Dan Carpenter @ 2011-10-29 7:20 UTC (permalink / raw)
To: kernel-janitors
tail_size is determined by several variables that come from the user
so we should verify that it's not too large.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/staging/sep/sep_driver.c b/drivers/staging/sep/sep_driver.c
index 8ac3fae..e624e28 100644
--- a/drivers/staging/sep/sep_driver.c
+++ b/drivers/staging/sep/sep_driver.c
@@ -2120,6 +2120,8 @@ static int sep_prepare_input_output_dma_table_in_dcb(struct sep_device *sep,
}
}
if (tail_size) {
+ if (tail_size > sizeof(dcb_table_ptr->tail_data))
+ return -EINVAL;
if (is_kva = true) {
memcpy(dcb_table_ptr->tail_data,
(void *)(app_in_address + data_in_size -
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [patch] Staging: sep: potential buffer overflow in ioctl
@ 2011-11-03 15:36 Alan Cox
0 siblings, 0 replies; 2+ messages in thread
From: Alan Cox @ 2011-11-03 15:36 UTC (permalink / raw)
To: kernel-janitors
On Sat, 29 Oct 2011 10:20:20 +0300
Dan Carpenter <dan.carpenter@oracle.com> wrote:
> tail_size is determined by several variables that come from the user
> so we should verify that it's not too large.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Alan Cox <alan@linux.intel.com>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-11-03 15:36 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-10-29 7:20 [patch] Staging: sep: potential buffer overflow in ioctl Dan Carpenter
-- strict thread matches above, loose matches on Subject: below --
2011-11-03 15:36 Alan Cox
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox