The patch titled
Subject: i2o: check copy_from_user() size parameter
has been removed from the -mm tree. Its filename was
i2o-check-copy_from_user-size-parameter.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Subject: i2o: check copy_from_user() size parameter
Limit the size of the copy so we don't corrupt memory. Hopefully this can
only be called by root, but fixing this makes the static checkers happier.
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Cc: Jiri Kosina <jkosina@xxxxxxx>
Cc: Masanari Iida <standby24x7@xxxxxxxxx>
Cc: Alan Cox <alan@xxxxxxxxxxxxxxx>
Cc: Guenter Roeck <linux@xxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
drivers/message/i2o/i2o_config.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff -puN drivers/message/i2o/i2o_config.c~i2o-check-copy_from_user-size-parameter drivers/message/i2o/i2o_config.c
--- a/drivers/message/i2o/i2o_config.c~i2o-check-copy_from_user-size-parameter
+++ a/drivers/message/i2o/i2o_config.c
@@ -687,6 +687,11 @@ static int i2o_cfg_passthru32(struct fil
}
size = size >> 16;
size *= 4;
+ if (size > sizeof(rmsg)) {
+ rcode = -EINVAL;
+ goto sg_list_cleanup;
+ }
+
/* Copy in the user's I2O command */
if (copy_from_user(rmsg, user_msg, size)) {
rcode = -EFAULT;
@@ -922,6 +927,11 @@ static int i2o_cfg_passthru(unsigned lon
}
size = size >> 16;
size *= 4;
+ if (size > sizeof(rmsg)) {
+ rcode = -EFAULT;
+ goto sg_list_cleanup;
+ }
+
/* Copy in the user's I2O command */
if (copy_from_user(rmsg, user_msg, size)) {
rcode = -EFAULT;
_
Patches currently in -mm which might be from dan.carpenter@xxxxxxxxxx are
origin.patch
linux-next.patch
mwave-fix-info-leak-in-mwave_ioctl.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
