On Fri, Apr 25, 2014 at 5:49 AM, Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote: > We copy "hdr->ioc_len" from the user twice but we only verify that it's > within the limit on the first copy. Otherwise we could read unmapped > memory and Oops. > Thanks for the patch. Reviewed-by: Peng Tao <bergwolf@xxxxxxxxx> > Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> > --- > Not tested. > > diff --git a/drivers/staging/lustre/lustre/obdclass/linux/linux-module.c b/drivers/staging/lustre/lustre/obdclass/linux/linux-module.c > index e4e94cc..dec1037 100644 > --- a/drivers/staging/lustre/lustre/obdclass/linux/linux-module.c > +++ b/drivers/staging/lustre/lustre/obdclass/linux/linux-module.c > @@ -122,6 +122,8 @@ int obd_ioctl_getdata(char **buf, int *len, void *arg) > OBD_FREE_LARGE(*buf, hdr.ioc_len); > return err; > } > + if (hdr.ioc_len != data->ioc_len) > + return -EINVAL; > > if (obd_ioctl_is_invalid(data)) { > CERROR("ioctl not correctly formatted\n"); > diff --git a/drivers/staging/lustre/lustre/libcfs/linux/linux-module.c b/drivers/staging/lustre/lustre/libcfs/linux/linux-module.c > index e6eae06..9a3b07b 100644 > --- a/drivers/staging/lustre/lustre/libcfs/linux/linux-module.c > +++ b/drivers/staging/lustre/lustre/libcfs/linux/linux-module.c > @@ -44,6 +44,7 @@ int libcfs_ioctl_getdata(char *buf, char *end, void *arg) > { > struct libcfs_ioctl_hdr *hdr; > struct libcfs_ioctl_data *data; > + int orig_len; > int err; > > hdr = (struct libcfs_ioctl_hdr *)buf; > @@ -69,9 +70,12 @@ int libcfs_ioctl_getdata(char *buf, char *end, void *arg) > return -EINVAL; > } > > + orig_len = hdr->ioc_len; > err = copy_from_user(buf, (void *)arg, hdr->ioc_len); > if (err) > return err; will you fix this as well? Thanks, Tao -- To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html