From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f196.google.com (mail-qk1-f196.google.com [209.85.222.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 811C77C for ; Mon, 4 Apr 2022 02:52:10 +0000 (UTC) Received: by mail-qk1-f196.google.com with SMTP id g8so6656424qke.2 for ; Sun, 03 Apr 2022 19:52:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=northvilleschools.net; s=google; h=date:from:to:cc:subject:message-id:mime-version:content-disposition; bh=otqIVowhU2obuVpjI9J66qJe/tdtEeQSkuJxEFFPVfw=; b=CYdW/tHTao9xYQkkEgM4OgPB4UeamwEomjOcg8DPUI8rOX8OH9QPHQ9pwOsr3PXen5 uAoZiT0jzn3JqOp1nHTNaYsBpTOPvoeGiFQ++RJcdVPEPZ+91aHTB4CtoS2pak06daaJ QgPNxuNn6qntkYIpS2zkLnxKPNVhP17KX2nnmUurTGUxczde02cM9z25fwMRYZwLD1oP ntk07CnKq2q5ATZllrLXCxFu5CEvZYhg8VQmvD8MEXF5PkoOfskZcjV0CzNDfgW2EnGO B1EceoKeBOszPct6xmvGEa4PKtxV0iMuttAIPfThwMiBzcpNB9C9M7guISP9/8l55LjE ET0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition; bh=otqIVowhU2obuVpjI9J66qJe/tdtEeQSkuJxEFFPVfw=; b=IRt1RUNWEYbVyl0rXJ/zSJeu+KZpNVyGSIptRvGnaSKIhOgj42xaI7KBTVwwS8lNHf tSYIISVDwFmk+UQ9KJWhcptEU2LpXPDN4TXmOnp86U9UdjT2jwMQ+5lre2tDXS1hkXBm wf/WhmKszGzXcOZtU7WnalP0sLMkULJtDKPLvilJBkFfXTDzU2rpU0zHlXwCPEslXEhT B28gs3fW0i70Ss9BOxN0C92caOif9uTbAQAoarzWnFkn3vuaJ4cKJbiqaWjpJeQxfPuH rTg26/s+0E+zBPzfZ7/CV+P8tdPlYId1WxOV0L/iX8jRbht8nnyIggd9UJMdMEHvJkWQ kgSA== X-Gm-Message-State: AOAM533Wy7+AlTGurBbD+TZdy76KlHzVmxiUuoFp3Hft+Wg+e/7L/YO9 ZhLhgzDWWyLWZ+ePbGwTWeiF5A== X-Google-Smtp-Source: ABdhPJwFMLKJkNF7xvI5cuv4J44M713fbdKhh8CxD5KdS58mIW4cgGnX17hUpDsJgB+iM1RsQDVJmg== X-Received: by 2002:a37:781:0:b0:67e:11a2:7d00 with SMTP id 123-20020a370781000000b0067e11a27d00mr12997820qkh.218.1649040729273; Sun, 03 Apr 2022 19:52:09 -0700 (PDT) Received: from sckzor-linux (d4-50-247-168.col.wideopenwest.com. [50.4.168.247]) by smtp.gmail.com with ESMTPSA id k13-20020a05622a03cd00b002e21621c243sm7872961qtx.39.2022.04.03.19.52.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 03 Apr 2022 19:52:08 -0700 (PDT) Date: Sun, 3 Apr 2022 22:52:07 -0400 From: Charlie Sands To: gregkh@linuxfoundation.org Cc: Larry.Finger@lwfinger.net, phil@philpotter.co.uk, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, paskripkin@gmail.com Subject: [PATCH V2] Fix unsafe memory access by memcmp Message-ID: Precedence: bulk X-Mailing-List: linux-staging@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline This patch fixes sparse warnings about the memcmp function unsafely accessing userspace memory without first copying it to kernel space. Signed-off-by: Charlie Sands --- V2: Fixed checkpatch.pl warning and changed variable name as suggested by Greg K. H. and improved error checking on the "copy_from_user" function as suggested by Pavel Skripkin. drivers/staging/r8188eu/os_dep/ioctl_linux.c | 21 ++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/drivers/staging/r8188eu/os_dep/ioctl_linux.c b/drivers/staging/r8188eu/os_dep/ioctl_linux.c index 7df213856d66..4b4eec2bde96 100644 --- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c +++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c @@ -3233,23 +3233,28 @@ static int rtw_p2p_get(struct net_device *dev, struct iw_request_info *info, union iwreq_data *wrqu, char *extra) { - if (!memcmp(wrqu->data.pointer, "status", 6)) { + char wrqu_data[9]; + + if (copy_from_user(wrqu_data, wrqu->data.pointer, 9) != 0) + return 0; + + if (!memcmp(wrqu_data, "status", 6)) { rtw_p2p_get_status(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "role", 4)) { + } else if (!memcmp(wrqu_data, "role", 4)) { rtw_p2p_get_role(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "peer_ifa", 8)) { + } else if (!memcmp(wrqu_data, "peer_ifa", 8)) { rtw_p2p_get_peer_ifaddr(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "req_cm", 6)) { + } else if (!memcmp(wrqu_data, "req_cm", 6)) { rtw_p2p_get_req_cm(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "peer_deva", 9)) { + } else if (!memcmp(wrqu_data, "peer_deva", 9)) { /* Get the P2P device address when receiving the provision discovery request frame. */ rtw_p2p_get_peer_devaddr(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "group_id", 8)) { + } else if (!memcmp(wrqu_data, "group_id", 8)) { rtw_p2p_get_groupid(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "peer_deva_inv", 9)) { + } else if (!memcmp(wrqu_data, "peer_deva_inv", 9)) { /* Get the P2P device address when receiving the P2P Invitation request frame. */ rtw_p2p_get_peer_devaddr_by_invitation(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "op_ch", 5)) { + } else if (!memcmp(wrqu_data, "op_ch", 5)) { rtw_p2p_get_op_ch(dev, info, wrqu, extra); } return 0; -- 2.35.1