* [patch 1/2] Staging: silicom: add some range checks to proc functions
@ 2012-09-14 6:56 Dan Carpenter
2012-09-14 7:08 ` Dan Carpenter
2012-09-14 8:11 ` Dan Carpenter
0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2012-09-14 6:56 UTC (permalink / raw)
To: kernel-janitors
If you tried to cat more than 255 characters (the last character is for
the terminator) to these proc files then it would corrupt kernel memory.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/staging/silicom/bp_mod.c b/drivers/staging/silicom/bp_mod.c
index 6e999c7..1b3f5e7 100644
--- a/drivers/staging/silicom/bp_mod.c
+++ b/drivers/staging/silicom/bp_mod.c
@@ -8227,6 +8227,9 @@ set_dis_bypass_pfs(struct file *file, const char *buffer,
int bypass_param = 0, length = 0;
+ if (count >= sizeof(kbuf))
+ return -EINVAL;
+
if (copy_from_user(&kbuf, buffer, count)) {
return -1;
}
@@ -8256,6 +8259,9 @@ set_dis_tap_pfs(struct file *file, const char *buffer,
int tap_param = 0, length = 0;
+ if (count >= sizeof(kbuf))
+ return -EINVAL;
+
if (copy_from_user(&kbuf, buffer, count)) {
return -1;
}
@@ -8285,6 +8291,9 @@ set_dis_disc_pfs(struct file *file, const char *buffer,
int tap_param = 0, length = 0;
+ if (count >= sizeof(kbuf))
+ return -EINVAL;
+
if (copy_from_user(&kbuf, buffer, count)) {
return -1;
}
@@ -8374,6 +8383,9 @@ set_bypass_pwup_pfs(struct file *file, const char *buffer,
int bypass_param = 0, length = 0;
+ if (count >= sizeof(kbuf))
+ return -EINVAL;
+
if (copy_from_user(&kbuf, buffer, count)) {
return -1;
}
@@ -8403,6 +8415,9 @@ set_bypass_pwoff_pfs(struct file *file, const char *buffer,
int bypass_param = 0, length = 0;
+ if (count >= sizeof(kbuf))
+ return -EINVAL;
+
if (copy_from_user(&kbuf, buffer, count)) {
return -1;
}
@@ -8432,6 +8447,9 @@ set_tap_pwup_pfs(struct file *file, const char *buffer,
int tap_param = 0, length = 0;
+ if (count >= sizeof(kbuf))
+ return -EINVAL;
+
if (copy_from_user(&kbuf, buffer, count)) {
return -1;
}
@@ -8461,6 +8479,9 @@ set_disc_pwup_pfs(struct file *file, const char *buffer,
int tap_param = 0, length = 0;
+ if (count >= sizeof(kbuf))
+ return -EINVAL;
+
if (copy_from_user(&kbuf, buffer, count)) {
return -1;
}
@@ -8570,6 +8591,9 @@ set_std_nic_pfs(struct file *file, const char *buffer,
int bypass_param = 0, length = 0;
+ if (count >= sizeof(kbuf))
+ return -EINVAL;
+
if (copy_from_user(&kbuf, buffer, count)) {
return -1;
}
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [patch 1/2] Staging: silicom: add some range checks to proc functions
2012-09-14 6:56 [patch 1/2] Staging: silicom: add some range checks to proc functions Dan Carpenter
@ 2012-09-14 7:08 ` Dan Carpenter
2012-09-14 8:11 ` Dan Carpenter
1 sibling, 0 replies; 3+ messages in thread
From: Dan Carpenter @ 2012-09-14 7:08 UTC (permalink / raw)
To: kernel-janitors
On Fri, Sep 14, 2012 at 09:56:00AM +0300, Dan Carpenter wrote:
> If you tried to cat more than 255 characters (the last character is for
> the terminator) to these proc files then it would corrupt kernel memory.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Actually sorry for this, I meant to check first before sending. Is
it possible to do a zero size write to a proc file? In sysfs it
isn't but I'm not sure about proc.
I may need to redo this.
regards,
dan carpenter
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [patch 1/2] Staging: silicom: add some range checks to proc functions
2012-09-14 6:56 [patch 1/2] Staging: silicom: add some range checks to proc functions Dan Carpenter
2012-09-14 7:08 ` Dan Carpenter
@ 2012-09-14 8:11 ` Dan Carpenter
1 sibling, 0 replies; 3+ messages in thread
From: Dan Carpenter @ 2012-09-14 8:11 UTC (permalink / raw)
To: kernel-janitors
On Fri, Sep 14, 2012 at 10:08:30AM +0300, Dan Carpenter wrote:
> On Fri, Sep 14, 2012 at 09:56:00AM +0300, Dan Carpenter wrote:
> > If you tried to cat more than 255 characters (the last character is for
> > the terminator) to these proc files then it would corrupt kernel memory.
> >
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> Actually sorry for this, I meant to check first before sending. Is
> it possible to do a zero size write to a proc file? In sysfs it
> isn't but I'm not sure about proc.
>
> I may need to redo this.
I'm just busy having a conversation with myself. This patch is
correct. Please apply it after all.
regards,
dan carpenter
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2012-09-14 8:11 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-09-14 6:56 [patch 1/2] Staging: silicom: add some range checks to proc functions Dan Carpenter
2012-09-14 7:08 ` Dan Carpenter
2012-09-14 8:11 ` Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).