Re: [PATCH] dm ioctl: prevent stack leak in dm ioctl call

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Apr 25, 2017 at 05:33:19PM -0700, Adrian Salido wrote:
> it's actually the data portion of the struct under a custom user ioctl
> where (param_kernel->data_size - minimum_data_size) <
> sizeof(param_kernel->data)
> Will update the patch to be clear

Yes - but before updating the patch, we need to be clearer about the
requirements of the ioctl here.

Why are two different minimum data sizes used?

If we let userspace send a truncated dm_ioctl struct, why are we not
returning the same truncated one?

Is this the bug?
  param->data_size = sizeof(*param);

Alasdair

--
dm-devel mailing list
dm-devel@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/dm-devel



[Index of Archives]     [DM Crypt]     [Fedora Desktop]     [ATA RAID]     [Fedora Marketing]     [Fedora Packaging]     [Fedora SELinux]     [Yosemite Discussion]     [KDE Users]     [Fedora Docs]

  Powered by Linux