Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752053AbcLGFkN (ORCPT ); Wed, 7 Dec 2016 00:40:13 -0500 Received: from linuxhacker.ru ([217.76.32.60]:58516 "EHLO fiona.linuxhacker.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751223AbcLGFkM (ORCPT ); Wed, 7 Dec 2016 00:40:12 -0500 From: Oleg Drokin To: Greg Kroah-Hartman , devel@driverdev.osuosl.org, Andreas Dilger , James Simmons Cc: Linux Kernel Mailing List , Lustre Development List , Oleg Drokin Subject: [PATCH] staging/lustre/lnetselftest: Fix potential integer overflow Date: Wed, 7 Dec 2016 00:39:27 -0500 Message-Id: <1481089167-1674826-1-git-send-email-green@linuxhacker.ru> X-Mailer: git-send-email 2.7.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1138 Lines: 31 It looks like if the passed in parameter is not present, but parameter length is non zero, then sanity checks on the length are skipped and lstcon_test_add() might then use incorrect allocation that's prone to integer overflow size. This patch ensures that parameter len is zero if parameter is not present. Reported-by: Dan Carpenter Signed-off-by: Oleg Drokin --- drivers/staging/lustre/lnet/selftest/conctl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/staging/lustre/lnet/selftest/conctl.c b/drivers/staging/lustre/lnet/selftest/conctl.c index 02847bf..9438302 100644 --- a/drivers/staging/lustre/lnet/selftest/conctl.c +++ b/drivers/staging/lustre/lnet/selftest/conctl.c @@ -742,6 +742,10 @@ static int lst_test_add_ioctl(lstio_test_args_t *args) PAGE_SIZE - sizeof(struct lstcon_test))) return -EINVAL; + /* Enforce zero parameter length if there's no parameter */ + if (!args->lstio_tes_param && args->lstio_tes_param_len) + return -EINVAL; + LIBCFS_ALLOC(batch_name, args->lstio_tes_bat_nmlen + 1); if (!batch_name) return rc; -- 2.7.4