ptp: oops in ptp_ioctl()

PATCH Applied Dan Carpenter 3 participants 3 messages May 26, 2016 – May 30, 2016

Subsystems (4)

Networking Network drivers Kernel janitors PTP hardware clock support

lore

Share & tools

lore

Dan Carpenter

author

2016-05-26 06:46 UTC #0 lore raw

PATCH 1/1 ptp: oops in ptp_ioctl()

If we pass ERR_PTR(-EFAULT) to kfree() then it's going to oops.

Fixes 2ece068e1b1d ('ptp: use memdup_user().')

Signed-off-by Dan Carpenter <[email protected]>

drivers/ptp/ptp_chardev.c +1 -0

index 0b1ac6b..d637c93 100644
@@ -211,6 +211,7 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg)
 		sysoff = memdup_user((void __user *)arg, sizeof(*sysoff));
 		if (IS_ERR(sysoff)) {
 			err = PTR_ERR(sysoff);
+			sysoff = NULL;
 			break;
 		}
 		if (sysoff->n_samples > PTP_MAX_SAMPLES) {

Richard Cochran

maintainer Acked-by on v1 1/1

2016-05-26 17:42 UTC #1 lore raw

Quoted 1 line · Dan Carpenter

If we pass ERR_PTR(-EFAULT) to kfree() then it's going to oops.

Thanks for catching this.

Acked-by Richard Cochran <[email protected]>

David Miller

maintainer Applied

2016-05-30 05:32 UTC #2 lore raw

In reply to Dan Carpenter

From: Dan Carpenter <[email protected]>
Date: Thu, 26 May 2016 09:46:22 +0300

Quoted 4 lines

If we pass ERR_PTR(-EFAULT) to kfree() then it's going to oops.
Fixes 2ece068e1b1d ('ptp: use memdup_user().')
Signed-off-by Dan Carpenter <[email protected]>

Applied, thanks.