Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754803Ab0GGMho (ORCPT ); Wed, 7 Jul 2010 08:37:44 -0400 Received: from einhorn.in-berlin.de ([192.109.42.8]:42824 "EHLO einhorn.in-berlin.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753671Ab0GGMhm (ORCPT ); Wed, 7 Jul 2010 08:37:42 -0400 X-Envelope-From: stefanr@s5r6.in-berlin.de Date: Wed, 7 Jul 2010 14:37:30 +0200 (CEST) From: Stefan Richter Subject: [PATCH v4] firewire: cdev: check write quadlet request length to avoid buffer overflow To: Clemens Ladisch cc: linux1394-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org In-Reply-To: Message-ID: References: <4C29C1CA.1050705@ladisch.de> <4C346B44.2020407@ladisch.de> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; CHARSET=us-ascii Content-Disposition: INLINE Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1718 Lines: 48 From: Clemens Ladisch Check that the data length of a write quadlet request actually is large enough for a quadlet. Otherwise, fw_fill_request could access the four bytes after the end of the outbound_transaction_event structure. Signed-off-by: Clemens Ladisch Modification of Clemens' change: Consolidate the check in init_request() which is used by the affected ioctl_send_request() and ioctl_send_broadcast_request() and the unaffected ioctl_send_stream_packet(), to save a few lines of code. Note, since struct outbound_transaction_event *e is slab-allocated, such an out-of-bounds access won't hit unallocated memory but may result in a (virtually impossible to exploit) information disclosure. Signed-off-by: Stefan Richter --- drivers/firewire/core-cdev.c | 4 ++++ 1 file changed, 4 insertions(+) Index: b/drivers/firewire/core-cdev.c =================================================================== --- a/drivers/firewire/core-cdev.c +++ b/drivers/firewire/core-cdev.c @@ -564,6 +564,10 @@ static int init_request(struct client *c (request->length > 4096 || request->length > 512 << speed)) return -EIO; + if (request->tcode == TCODE_WRITE_QUADLET_REQUEST && + request->length < 4) + return -EINVAL; + e = kmalloc(sizeof(*e) + request->length, GFP_KERNEL); if (e == NULL) return -ENOMEM; -- Stefan Richter -=====-==-=- -=== --=== http://arcgraph.de/sr/ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/