staging: lustre: libcfs: double copy bug

PATCH New Dan Carpenter 1 participant 1 message Jan 30, 2017 Staging

Share & tools

Dan Carpenter

author

2017-01-30 10:51 UTC #0 lore raw

PATCH 1/1 staging: lustre: libcfs: double copy bug

The problem is that we copy hdr.ioc_len, we verify it, then we copy it again without checking to see if it has changed in between the two copies.

This could result in an information leak.

Signed-off-by Dan Carpenter <[email protected]>

drivers/staging/lustre/lnet/libcfs/linux/linux-module.c +13 -2

index 3f5d58babc2f..075826bd3a2a 100644
@@ -122,7 +122,7 @@ int libcfs_ioctl_getdata(struct libcfs_ioctl_hdr **hdr_pp,
 			 const struct libcfs_ioctl_hdr __user *uhdr)
 {
 	struct libcfs_ioctl_hdr hdr;
-	int err = 0;
+	int err;
 
 	if (copy_from_user(&hdr, uhdr, sizeof(hdr)))
 		return -EFAULT;

@@ -150,9 +150,20 @@ int libcfs_ioctl_getdata(struct libcfs_ioctl_hdr **hdr_pp,
 		return -ENOMEM;
 
 	if (copy_from_user(*hdr_pp, uhdr, hdr.ioc_len)) {
-		LIBCFS_FREE(*hdr_pp, hdr.ioc_len);
 		err = -EFAULT;
+		goto free;
 	}
+
+	if ((*hdr_pp)->ioc_version != hdr.ioc_version ||
+	    (*hdr_pp)->ioc_len != hdr.ioc_len) {
+		err = -EINVAL;
+		goto free;
+	}
+
+	return 0;
+
+free:
+	LIBCFS_FREE(*hdr_pp, hdr.ioc_len);
 	return err;
 }