On Fri, Oct 08, 2010 at 09:03:07AM +0200, Dan Carpenter wrote: > gdth_ioctl_alloc() takes the size variable as an int. > copy_from_user() takes the size variable as an unsigned long. > gen.data_len and gen.sense_len are unsigned longs. > On x86_64 longs are 64 bit and ints are 32 bit. > > We could pass in a very large number and the allocation would truncate > the size to 32 bits and allocate a small buffer. Then when we do the > copy_from_user(), it would result in a memory corruption. > > CC: stable@xxxxxxxxxx > Signed-off-by: Dan Carpenter <error27@xxxxxxxxx> > I never know if anyone gets my emails and so I has a small sad face on the front of my head here: ---------------> :( regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
