Received: by 2002:a05:6a10:2726:0:0:0:0 with SMTP id ib38csp3492518pxb; Mon, 4 Apr 2022 18:43:40 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzXdzaI2THFr0qlpyP2Fn6cAJYN9Xv5PURS7gpMcgbMbGrE55z2UonLXefQCbN3n3gTKl2C X-Received: by 2002:a17:903:22c2:b0:154:565b:b273 with SMTP id y2-20020a17090322c200b00154565bb273mr1103243plg.115.1649123020628; Mon, 04 Apr 2022 18:43:40 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1649123020; cv=none; d=google.com; s=arc-20160816; b=C8BL5OE7Uad9E/MQSdS/j1ymlm59DevqSPazg18dpSOj9mLu5z7eCOpdaMSBRw6kY/ 2NYTyW3UhNzJJ+QUnCPngC1k69YDZMy6Tqg7u/DVDoeK6I6dBqPtnBatpkEAGVZasZsE FNv4lCWp8cVgEHXY9lNBsAVMlTxXUE7p4xTAMJWqgXEwhRVm44Ny5DwP/umMRKJhBaCg t6sWsy4/1BDb692l7+oGW3RkpHoBD9RO4u4lMS9NabP0tnPIoyXPGrlFMcGlvZ7MDbTx FyyybGwSn5ouEEVd39VmUppWSaDLCOPlkVEnSUTGUrfVn/oEKdFmvxI5gi43IzAnu0d6 ElKA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-disposition:mime-version:message-id :subject:cc:to:from:date:dkim-signature; bh=otqIVowhU2obuVpjI9J66qJe/tdtEeQSkuJxEFFPVfw=; b=wHu3XfOxhjd53j1fFW3oYzw0rfIWcBhLsCkWIpVLsphQphnqrN4YLn0q5pqyc1Pu5Z JzdngXT1RB81R0lnUTecNvKdgqQA1Jc4kcZItpCvfO4em7Jm5RaKPoIsQOQkjm+elBdb nTCr2cdzh7HICRCUckS6LzdHW23lSPLS7B4BSBHsGkCC9m5nc2X669uKQHeLYw2qSzqP LGXjhmYpBDDQ1oivTqozzscba1LHIrAxWGMRHXQXsy7lM/E5QdI1Pgarq/rOHVjLc+Qg 1AKmhBHApTtuMi/Gyzncv+SorfNGHvNoiuOMdM1siAw0JESyV2OZRgH//C5GRnn/ObLg zMxw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@northvilleschools.net header.s=google header.b="CYdW/tHT"; spf=softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=northvilleschools.net Return-Path: Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net. [23.128.96.19]) by mx.google.com with ESMTPS id mh9-20020a17090b4ac900b001bd14e01f4dsi713398pjb.59.2022.04.04.18.43.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Apr 2022 18:43:40 -0700 (PDT) Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19; Authentication-Results: mx.google.com; dkim=pass header.i=@northvilleschools.net header.s=google header.b="CYdW/tHT"; spf=softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=northvilleschools.net Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id B85A32A2656; Mon, 4 Apr 2022 17:42:22 -0700 (PDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376948AbiDDCyH (ORCPT + 99 others); Sun, 3 Apr 2022 22:54:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48892 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238893AbiDDCyG (ORCPT ); Sun, 3 Apr 2022 22:54:06 -0400 Received: from mail-qk1-x741.google.com (mail-qk1-x741.google.com [IPv6:2607:f8b0:4864:20::741]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2BD6B396A1 for ; Sun, 3 Apr 2022 19:52:10 -0700 (PDT) Received: by mail-qk1-x741.google.com with SMTP id q200so6637190qke.7 for ; Sun, 03 Apr 2022 19:52:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=northvilleschools.net; s=google; h=date:from:to:cc:subject:message-id:mime-version:content-disposition; bh=otqIVowhU2obuVpjI9J66qJe/tdtEeQSkuJxEFFPVfw=; b=CYdW/tHTao9xYQkkEgM4OgPB4UeamwEomjOcg8DPUI8rOX8OH9QPHQ9pwOsr3PXen5 uAoZiT0jzn3JqOp1nHTNaYsBpTOPvoeGiFQ++RJcdVPEPZ+91aHTB4CtoS2pak06daaJ QgPNxuNn6qntkYIpS2zkLnxKPNVhP17KX2nnmUurTGUxczde02cM9z25fwMRYZwLD1oP ntk07CnKq2q5ATZllrLXCxFu5CEvZYhg8VQmvD8MEXF5PkoOfskZcjV0CzNDfgW2EnGO B1EceoKeBOszPct6xmvGEa4PKtxV0iMuttAIPfThwMiBzcpNB9C9M7guISP9/8l55LjE ET0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition; bh=otqIVowhU2obuVpjI9J66qJe/tdtEeQSkuJxEFFPVfw=; b=gLnFJt4XDBzfkGDq1U+nJbZIFzq/Y3ifwU4CpicpAZd7Lnhfy2ek+C29sL3Zdgfaiy 5XqPSPU7fKCV51RIFnkH3yZnQwMb46UI6SS1ZNjHv6CUgKmp/iV6QHRznY2LdgfeSISI fOFKHsi4CaNDXFYqPd2R97/f0a7iTyzJvze3XNYI3BvYwXjo8wjgF5+VZIb2twWsgvdO 4xIbRbgWcUmHKaNb6K1yNjuTIpme4Bej99x3FuIWoewB7BVIV0/ds+guX7iMjH4i/S3E dnF95v50xVOZk10NiHLgUnGQF0XIrQP5VGX/qk8tPYUghEXvxfKsUpuCiMxXHwo8qpn1 4cTw== X-Gm-Message-State: AOAM533ZeVtJ/UHetnhwdE8K6T/r6ok0tE68LvUCV77de2Gx9kH0Tsgs 0kDWQ4YRP9FSp8oa0jynPDWOzw== X-Received: by 2002:a37:781:0:b0:67e:11a2:7d00 with SMTP id 123-20020a370781000000b0067e11a27d00mr12997820qkh.218.1649040729273; Sun, 03 Apr 2022 19:52:09 -0700 (PDT) Received: from sckzor-linux (d4-50-247-168.col.wideopenwest.com. [50.4.168.247]) by smtp.gmail.com with ESMTPSA id k13-20020a05622a03cd00b002e21621c243sm7872961qtx.39.2022.04.03.19.52.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 03 Apr 2022 19:52:08 -0700 (PDT) Date: Sun, 3 Apr 2022 22:52:07 -0400 From: Charlie Sands To: gregkh@linuxfoundation.org Cc: Larry.Finger@lwfinger.net, phil@philpotter.co.uk, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, paskripkin@gmail.com Subject: [PATCH V2] Fix unsafe memory access by memcmp Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This patch fixes sparse warnings about the memcmp function unsafely accessing userspace memory without first copying it to kernel space. Signed-off-by: Charlie Sands --- V2: Fixed checkpatch.pl warning and changed variable name as suggested by Greg K. H. and improved error checking on the "copy_from_user" function as suggested by Pavel Skripkin. drivers/staging/r8188eu/os_dep/ioctl_linux.c | 21 ++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/drivers/staging/r8188eu/os_dep/ioctl_linux.c b/drivers/staging/r8188eu/os_dep/ioctl_linux.c index 7df213856d66..4b4eec2bde96 100644 --- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c +++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c @@ -3233,23 +3233,28 @@ static int rtw_p2p_get(struct net_device *dev, struct iw_request_info *info, union iwreq_data *wrqu, char *extra) { - if (!memcmp(wrqu->data.pointer, "status", 6)) { + char wrqu_data[9]; + + if (copy_from_user(wrqu_data, wrqu->data.pointer, 9) != 0) + return 0; + + if (!memcmp(wrqu_data, "status", 6)) { rtw_p2p_get_status(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "role", 4)) { + } else if (!memcmp(wrqu_data, "role", 4)) { rtw_p2p_get_role(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "peer_ifa", 8)) { + } else if (!memcmp(wrqu_data, "peer_ifa", 8)) { rtw_p2p_get_peer_ifaddr(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "req_cm", 6)) { + } else if (!memcmp(wrqu_data, "req_cm", 6)) { rtw_p2p_get_req_cm(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "peer_deva", 9)) { + } else if (!memcmp(wrqu_data, "peer_deva", 9)) { /* Get the P2P device address when receiving the provision discovery request frame. */ rtw_p2p_get_peer_devaddr(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "group_id", 8)) { + } else if (!memcmp(wrqu_data, "group_id", 8)) { rtw_p2p_get_groupid(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "peer_deva_inv", 9)) { + } else if (!memcmp(wrqu_data, "peer_deva_inv", 9)) { /* Get the P2P device address when receiving the P2P Invitation request frame. */ rtw_p2p_get_peer_devaddr_by_invitation(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "op_ch", 5)) { + } else if (!memcmp(wrqu_data, "op_ch", 5)) { rtw_p2p_get_op_ch(dev, info, wrqu, extra); } return 0; -- 2.35.1