[PATCH 2.4] Using possibly corrupted structure in atm/he.c

[Felipe W Damasio <felipewd@terra.com.br>]

[-- Attachment #1: Type: text/plain, Size: 557 bytes --]

	Hi Marcelo/Chas,

	Patch against 2.4.23-pre5.

	If copy_from_user returns != 0, it means the the regs structure 
wasn't filled correctly, and since its fields are used to determine 
which ioctl the user is requesting the kernel could oops.

	And as long as we're covering the subject, the patch also audits 
copy_to_user on the same function to check a possible failure to copy 
the result back to userspace.

	These bugs were found by smatch in the 2.6 kernel, but I think it's 
worth fixing them in 2.4 too.

	Please consider applying.

	Cheers,

Felipe

[-- Attachment #2: atm_he-copy.patch --]
[-- Type: text/plain, Size: 913 bytes --]

--- linux-2.4.23-pre5/drivers/atm/he.c.orig	2003-09-22 11:41:20.000000000 -0300
+++ linux-2.4.23-pre5/drivers/atm/he.c	2003-09-22 11:44:50.000000000 -0300
@@ -2866,8 +2866,10 @@
 			if (!capable(CAP_NET_ADMIN))
 				return -EPERM;
 
-			copy_from_user(&reg, (struct he_ioctl_reg *) arg,
-						sizeof(struct he_ioctl_reg));
+			if (copy_from_user(&reg, (struct he_ioctl_reg *) arg,
+						sizeof(struct he_ioctl_reg)))
+				return -EFAULT;
+				
 			spin_lock_irqsave(&he_dev->global_lock, flags);
 			switch (reg.type) {
 				case HE_REGTYPE_PCI:
@@ -2891,8 +2893,9 @@
 			}
 			spin_unlock_irqrestore(&he_dev->global_lock, flags);
 			if (err == 0)
-				copy_to_user((struct he_ioctl_reg *) arg, &reg,
-							sizeof(struct he_ioctl_reg));
+				if (copy_to_user((struct he_ioctl_reg *) arg, &reg,
+							sizeof(struct he_ioctl_reg)))
+					return -EFAULT;
 			break;
 		default:
 #ifdef CONFIG_ATM_HE_USE_SUNI