2010-08-23 21:06:09

by Arnaud Patard

Subject: [patch 1/1 v2] rt2x00: fix "buffer size not provably correct" build warning

rt2x00 debugfs interface doesn't check the size of the data coming
from userspace, leading to a build warning. Fix That.

v2: return EINVAL if input is too long

Signed-off-by: Arnaud Patard <[email protected]>

Index: rt2x00/drivers/net/wireless/rt2x00/rt2x00debug.c
===================================================================
--- rt2x00.orig/drivers/net/wireless/rt2x00/rt2x00debug.c 2010-08-23 18:03:31.414826113 +0200
+++ rt2x00/drivers/net/wireless/rt2x00/rt2x00debug.c 2010-08-23 20:37:24.894366547 +0200
@@ -480,6 +480,9 @@ static ssize_t rt2x00debug_write_##__nam
if (index >= debug->__name.word_count) \
return -EINVAL; \
\
+ if (length > sizeof(line)) \
+ return -EINVAL; \
+ \
if (copy_from_user(line, buf, length)) \
return -EFAULT; \
\

2010-08-23 22:10:07

by Ivo Van Doorn

Subject: Re: [patch 1/1 v2] rt2x00: fix "buffer size not provably correct" build warning

T24gTW9uLCBBdWcgMjMsIDIwMTAgYXQgMTE6MDIgUE0sIEFybmF1ZCBQYXRhcmQKPGFybmF1ZC5w
YXRhcmRAcnRwLW5ldC5vcmc+IHdyb3RlOgo+IHJ0MngwMCBkZWJ1Z2ZzIGludGVyZmFjZSBkb2Vz
bid0IGNoZWNrIHRoZSBzaXplIG9mIHRoZSBkYXRhIGNvbWluZwo+IGZyb20gdXNlcnNwYWNlLCBs
ZWFkaW5nIHRvIGEgYnVpbGQgd2FybmluZy4gRml4IFRoYXQuCj4KPiB2MjogcmV0dXJuIEVJTlZB
TCBpZiBpbnB1dCBpcyB0b28gbG9uZwoKVGhhbmtzIQoKPiBTaWduZWQtb2ZmLWJ5OiBBcm5hdWQg
UGF0YXJkIDxhcm5hdWQucGF0YXJkQHJ0cC1uZXQub3JnPgoKQWNrZWQtYnk6IEl2byB2YW4gRG9v
cm4gPEl2RG9vcm5AZ21haWwuY29tPgoKPiBJbmRleDogcnQyeDAwL2RyaXZlcnMvbmV0L3dpcmVs
ZXNzL3J0MngwMC9ydDJ4MDBkZWJ1Zy5jCj4gPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQo+IC0tLSBydDJ4MDAub3JpZy9k
cml2ZXJzL25ldC93aXJlbGVzcy9ydDJ4MDAvcnQyeDAwZGVidWcuYyCgIKAgoCAyMDEwLTA4LTIz
IDE4OjAzOjMxLjQxNDgyNjExMyArMDIwMAo+ICsrKyBydDJ4MDAvZHJpdmVycy9uZXQvd2lyZWxl
c3MvcnQyeDAwL3J0MngwMGRlYnVnLmMgoCCgMjAxMC0wOC0yMyAyMDozNzoyNC44OTQzNjY1NDcg
KzAyMDAKPiBAQCAtNDgwLDYgKzQ4MCw5IEBAIHN0YXRpYyBzc2l6ZV90IHJ0MngwMGRlYnVnX3dy
aXRlXyMjX19uYW0KPiCgIKAgoCCgaWYgKGluZGV4ID49IGRlYnVnLT5fX25hbWUud29yZF9jb3Vu
dCkgoCCgIKAgoCCgIKAgoCCgIKBcCj4goCCgIKAgoCCgIKAgoCCgcmV0dXJuIC1FSU5WQUw7IKAg
oCCgIKAgoCCgIKAgoCCgIKAgoCCgIKAgoCCgIKAgXAo+IKAgoCCgIKAgoCCgIKAgoCCgIKAgoCCg
IKAgoCCgIKAgoCCgIKAgoCCgIKAgoCCgIKAgoCCgIKAgoCCgIKAgoFwKPiArIKAgoCCgIGlmIChs
ZW5ndGggPiBzaXplb2YobGluZSkpIKAgoCCgIKAgoCCgIKAgoCCgIKAgoCCgIKAgoCCgXAo+ICsg
oCCgIKAgoCCgIKAgoCByZXR1cm4gLUVJTlZBTDsgoCCgIKAgoCCgIKAgoCCgIKAgoCCgIKAgoCCg
IKAgoCBcCj4gKyCgIKAgoCCgIKAgoCCgIKAgoCCgIKAgoCCgIKAgoCCgIKAgoCCgIKAgoCCgIKAg
oCCgIKAgoCCgIKAgoCCgIFwKPiCgIKAgoCCgaWYgKGNvcHlfZnJvbV91c2VyKGxpbmUsIGJ1Ziwg
bGVuZ3RoKSkgoCCgIKAgoCCgIKAgoCCgIKBcCj4goCCgIKAgoCCgIKAgoCCgcmV0dXJuIC1FRkFV
TFQ7IKAgoCCgIKAgoCCgIKAgoCCgIKAgoCCgIKAgoCCgIKAgXAo+IKAgoCCgIKAgoCCgIKAgoCCg
IKAgoCCgIKAgoCCgIKAgoCCgIKAgoCCgIKAgoCCgIKAgoCCgIKAgoCCgIKAgoFwKPgo+Cj4K