Skip to contentSkip to conversation

Staging: silicom: add some range checks to proc functions

PATCH In review Dan Carpenter 1 participant 3 messages Sep 14, 2012

Subsystems (2)
Staging Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/2 Staging: silicom: add some range checks to proc functions

If you tried to cat more than 255 characters (the last character is for the terminator) to these proc files then it would corrupt kernel memory.

Signed-off-by Dan Carpenter <[email protected]>
drivers/staging/silicom/bp_mod.c +24 -0
index 6e999c7..1b3f5e7 100644
@@ -8227,6 +8227,9 @@ set_dis_bypass_pfs(struct file *file, const char *buffer,
 
 	int bypass_param = 0, length = 0;
 
+	if (count >= sizeof(kbuf))
+		return -EINVAL;
+
 	if (copy_from_user(&kbuf, buffer, count)) {
 		return -1;
 	}

@@ -8256,6 +8259,9 @@ set_dis_tap_pfs(struct file *file, const char *buffer,
 
 	int tap_param = 0, length = 0;
 
+	if (count >= sizeof(kbuf))
+		return -EINVAL;
+
 	if (copy_from_user(&kbuf, buffer, count)) {
 		return -1;
 	}

@@ -8285,6 +8291,9 @@ set_dis_disc_pfs(struct file *file, const char *buffer,
 
 	int tap_param = 0, length = 0;
 
+	if (count >= sizeof(kbuf))
+		return -EINVAL;
+
 	if (copy_from_user(&kbuf, buffer, count)) {
 		return -1;
 	}

@@ -8374,6 +8383,9 @@ set_bypass_pwup_pfs(struct file *file, const char *buffer,
 
 	int bypass_param = 0, length = 0;
 
+	if (count >= sizeof(kbuf))
+		return -EINVAL;
+
 	if (copy_from_user(&kbuf, buffer, count)) {
 		return -1;
 	}

@@ -8403,6 +8415,9 @@ set_bypass_pwoff_pfs(struct file *file, const char *buffer,
 
 	int bypass_param = 0, length = 0;
 
+	if (count >= sizeof(kbuf))
+		return -EINVAL;
+
 	if (copy_from_user(&kbuf, buffer, count)) {
 		return -1;
 	}

@@ -8432,6 +8447,9 @@ set_tap_pwup_pfs(struct file *file, const char *buffer,
 
 	int tap_param = 0, length = 0;
 
+	if (count >= sizeof(kbuf))
+		return -EINVAL;
+
 	if (copy_from_user(&kbuf, buffer, count)) {
 		return -1;
 	}

@@ -8461,6 +8479,9 @@ set_disc_pwup_pfs(struct file *file, const char *buffer,
 
 	int tap_param = 0, length = 0;
 
+	if (count >= sizeof(kbuf))
+		return -EINVAL;
+
 	if (copy_from_user(&kbuf, buffer, count)) {
 		return -1;
 	}

@@ -8570,6 +8591,9 @@ set_std_nic_pfs(struct file *file, const char *buffer,
 
 	int bypass_param = 0, length = 0;
 
+	if (count >= sizeof(kbuf))
+		return -EINVAL;
+
 	if (copy_from_user(&kbuf, buffer, count)) {
 		return -1;
 	}
author
#1 lore raw
Quoted 4 lines · Dan Carpenter

If you tried to cat more than 255 characters (the last character is for the terminator) to these proc files then it would corrupt kernel memory.

Signed-off-by Dan Carpenter <[email protected]>

Actually sorry for this, I meant to check first before sending. Is it possible to do a zero size write to a proc file? In sysfs it isn't but I'm not sure about proc.

I may need to redo this.

regards,
dan carpenter

author
#2 lore raw
In reply to Dan Carpenter
Quoted 11 lines · Dan Carpenter
Quoted 4 lines · Dan Carpenter

If you tried to cat more than 255 characters (the last character is for the terminator) to these proc files then it would corrupt kernel memory.

Signed-off-by Dan Carpenter <[email protected]>

Actually sorry for this, I meant to check first before sending. Is it possible to do a zero size write to a proc file? In sysfs it isn't but I'm not sure about proc.

I may need to redo this.

I'm just busy having a conversation with myself. This patch is correct. Please apply it after all.

regards,
dan carpenter