redonkable/alistair23-linux
redonkable/alistair23-linux
1
0
Fork 0
Code Releases Activity

Staging: bcm: use get_user() to access user pointers

Browse source 
This fixes some places that dereference user pointers directly instead
of using get_user().

Please especially check my changes to IOCTL_BCM_GET_CURRENT_STATUS.  The
original code modified the struct which "arg" was pointing to.  I think
this was a bug in the original code and that we only wanted to write to
the OutputBuffer. Also with the original code you could read as much
memory as you wanted so I had to put a cap on OutputLength.  The only
value of OutputLength that makes sense is sizeof(LINK_STATE) so now if
OutputLength is not sizeof(LINK_STATE) it returns -EINVAL.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Dan Carpenter 2010-10-21 07:46:58 +02:00 committed by Greg Kroah-Hartman
parent 4fc718a4b0
commit eccbf04a90
1 changed files with 32 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

49
drivers/staging/bcm/Bcmchar.c
View file

@ -1001,13 +1001,15 @@ static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg)
}
#endif
case IOCTL_BE_BUCKET_SIZE:
Adapter->BEBucketSize = *(PULONG)arg;
Status = STATUS_SUCCESS;
Status = 0;
if (get_user(Adapter->BEBucketSize, (unsigned long __user *)arg))
Status = -EFAULT;
break;
case IOCTL_RTPS_BUCKET_SIZE:
Adapter->rtPSBucketSize = *(PULONG)arg;
Status = STATUS_SUCCESS;
Status = 0;
if (get_user(Adapter->rtPSBucketSize, (unsigned long __user *)arg))
Status = -EFAULT;
break;
case IOCTL_CHIP_RESET:
{
@ -1028,11 +1030,15 @@ static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg)
case IOCTL_QOS_THRESHOLD:
{
USHORT uiLoopIndex;
for(uiLoopIndex = 0 ; uiLoopIndex < NO_OF_QUEUES ; uiLoopIndex++)
{
Adapter->PackInfo[uiLoopIndex].uiThreshold = *(PULONG)arg;
Status = 0;
for (uiLoopIndex = 0; uiLoopIndex < NO_OF_QUEUES; uiLoopIndex++) {
if (get_user(Adapter->PackInfo[uiLoopIndex].uiThreshold,
(unsigned long __user *)arg)) {
Status = -EFAULT;
break;
}
}
Status = STATUS_SUCCESS;
break;
}
@ -1093,7 +1099,8 @@ static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg)
}
case IOCTL_BCM_GET_CURRENT_STATUS:
{
LINK_STATE *plink_state = NULL;
LINK_STATE plink_state;
/* Copy Ioctl Buffer structure */
if(copy_from_user(&IoBuffer, argp, sizeof(IOCTL_BUFFER)))
{
@ -1101,13 +1108,19 @@ static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg)
Status = -EFAULT;
break;
}
plink_state = (LINK_STATE*)arg;
plink_state->bIdleMode = (UCHAR)Adapter->IdleMode;
plink_state->bShutdownMode = Adapter->bShutStatus;
plink_state->ucLinkStatus = (UCHAR)Adapter->LinkStatus;
if(copy_to_user(IoBuffer.OutputBuffer,
(PUCHAR)plink_state, (UINT)IoBuffer.OutputLength))
{
if (IoBuffer.OutputLength != sizeof(plink_state)) {
Status = -EINVAL;
break;
}
if (copy_from_user(&plink_state, (void __user *)arg, sizeof(plink_state))) {
Status = -EFAULT;
break;
}
plink_state.bIdleMode = (UCHAR)Adapter->IdleMode;
plink_state.bShutdownMode = Adapter->bShutStatus;
plink_state.ucLinkStatus = (UCHAR)Adapter->LinkStatus;
if (copy_to_user(IoBuffer.OutputBuffer, &plink_state, IoBuffer.OutputLength)) {
BCM_DEBUG_PRINT(Adapter,DBG_TYPE_PRINTK, 0, 0, "Copy_to_user Failed..\n");
Status = -EFAULT;
break;
@ -1331,7 +1344,9 @@ static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg)
BCM_DEBUG_PRINT(Adapter,DBG_TYPE_PRINTK, 0, 0,"Copy From User space failed. status :%d", Status);
return -EFAULT;
}
uiSectorSize = *((PUINT)(IoBuffer.InputBuffer)); /* FIXME: unchecked __user access */
if (get_user(uiSectorSize, (unsigned int __user *)IoBuffer.InputBuffer))
return -EFAULT;
if((uiSectorSize < MIN_SECTOR_SIZE) || (uiSectorSize > MAX_SECTOR_SIZE))
{