The patch titled
Subject: i2o: check copy_from_user() size parameter
has been added to the -mm tree. Its filename is
i2o-check-copy_from_user-size-parameter.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Subject: i2o: check copy_from_user() size parameter
Limit the size of the copy so we don't corrupt memory. Hopefully this can
only be called by root, but fixing this makes the static checkers happier.
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Cc: Jiri Kosina <jkosina@xxxxxxx>
Cc: Masanari Iida <standby24x7@xxxxxxxxx>
Cc: Alan Cox <alan@xxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
drivers/message/i2o/i2o_config.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff -puN drivers/message/i2o/i2o_config.c~i2o-check-copy_from_user-size-parameter drivers/message/i2o/i2o_config.c
--- a/drivers/message/i2o/i2o_config.c~i2o-check-copy_from_user-size-parameter
+++ a/drivers/message/i2o/i2o_config.c
@@ -687,6 +687,11 @@ static int i2o_cfg_passthru32(struct fil
}
size = size >> 16;
size *= 4;
+ if (size > sizeof(rmsg)) {
+ rcode = -EINVAL;
+ goto sg_list_cleanup;
+ }
+
/* Copy in the user's I2O command */
if (copy_from_user(rmsg, user_msg, size)) {
rcode = -EFAULT;
@@ -922,6 +927,11 @@ static int i2o_cfg_passthru(unsigned lon
}
size = size >> 16;
size *= 4;
+ if (size > sizeof(rmsg)) {
+ rcode = -EFAULT;
+ goto sg_list_cleanup;
+ }
+
/* Copy in the user's I2O command */
if (copy_from_user(rmsg, user_msg, size)) {
rcode = -EFAULT;
_
Patches currently in -mm which might be from dan.carpenter@xxxxxxxxxx are
origin.patch
linux-next.patch
i2o-check-copy_from_user-size-parameter.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
