Staging: lustre: integer overflow in ioctl

PATCH New Dan Carpenter 1 participant 1 message Apr 1, 2015

Subsystems (2)

Staging Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2015-04-01 08:12 UTC #0 lore raw

PATCH 1/2 Staging: lustre: integer overflow in ioctl

hdr->ioc_len is a user controlled u32 so the addition can overflow, especially on 32 bit systems.

Signed-off-by Dan Carpenter <[email protected]>

drivers/staging/lustre/lustre/libcfs/linux/linux-module.c +1 -1

index a5effcd..e962f89 100644
@@ -57,7 +57,7 @@ int libcfs_ioctl_getdata(char *buf, char *end, void *arg)
 		return -EINVAL;
 	}
 
-	if (hdr->ioc_len + buf >= end) {
+	if (hdr->ioc_len >= end - buf) {
 		CERROR("PORTALS: user buffer exceeds kernel buffer\n");
 		return -EINVAL;
 	}