Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751733AbbLHS01 (ORCPT ); Tue, 8 Dec 2015 13:26:27 -0500 Received: from mailhub.eng.utah.edu ([155.98.110.27]:61655 "EHLO mailhub.eng.utah.edu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751152AbbLHS00 (ORCPT ); Tue, 8 Dec 2015 13:26:26 -0500 Subject: Re: [PATCH] dm ioctl: Access user-land memory through safe functions. To: agk@redhat.com, snitzer@redhat.com References: <565DE2B8.7040709@eng.utah.edu> Cc: linux-kernel@vger.kernel.org, dm-devel@redhat.com From: Scotty Bauer Message-ID: <566720D0.8080509@eng.utah.edu> Date: Tue, 8 Dec 2015 11:26:24 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: <565DE2B8.7040709@eng.utah.edu> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-UCE-Score: -2.2 (--) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1972 Lines: 56 On 12/01/2015 11:11 AM, Scotty wrote: > > 0001-dm-ioctl-Access-user-land-memory-through-safe-functi.patch > > > From b26adf880eba03ac6f2b1dd87426bb96fd2a0282 Mon Sep 17 00:00:00 2001 > From: Scotty Bauer > Date: Tue, 1 Dec 2015 10:52:46 -0700 > Subject: [PATCH] dm ioctl: Access user-land memory through safe functions. > > This patch fixes a user-land dereference. Now we use > the safe copy_from_user to access the memory. > > Signed-off-by: Scotty Bauer > --- > drivers/md/dm-ioctl.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c > index 80a4395..39a9d1a 100644 > --- a/drivers/md/dm-ioctl.c > +++ b/drivers/md/dm-ioctl.c > @@ -1642,9 +1642,13 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags) > static int check_version(unsigned int cmd, struct dm_ioctl __user *user) > { > uint32_t version[3]; > + uint32_t __user *version_ptr; > int r = 0; > > - if (copy_from_user(version, user->version, sizeof(version))) > + if (copy_from_user(&version_ptr, &user->version, sizeof(version_ptr))) > + return -EFAULT; > + > + if (copy_from_user(version, version_ptr, sizeof(version))) > return -EFAULT; > > if ((DM_VERSION_MAJOR != version[0]) || > @@ -1663,7 +1667,7 @@ static int check_version(unsigned int cmd, struct dm_ioctl __user *user) > version[0] = DM_VERSION_MAJOR; > version[1] = DM_VERSION_MINOR; > version[2] = DM_VERSION_PATCHLEVEL; > - if (copy_to_user(user->version, version, sizeof(version))) > + if (copy_to_user(version_ptr, version, sizeof(version))) > return -EFAULT; > > return r; > -- Friendly ping, is anyone interested in this? -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/