Attachment 314237 Details for Bug 458758 – Patch modified by Eugene Teo, including the missing bits for -77

[patch] Patch modified by Eugene Teo, including the missing bits for -77

bz458758--dlm-dlm-user.c-input-validation-fixes.patch (text/plain), 3.03 KB, created by Luis Claudio R. Goncalves on 2008-08-13 19:11:33 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Luis Claudio R. Goncalves

Created: 2008-08-13 19:11:33 UTC

Size: 3.03 KB

patch

obsolete

>This is a slightly modified version of the patch described below.
>
>It is slightly different because of 2a79289e87f3b6487b5fd23c8569f32097057fb4.
>cb79f1998d89821a4dbac47f59a46ee3fbbf3c61 went in later to fix compat_input().
>
>Eugene Teo backported the patch and a few needed bits in order to apply this
>patch to 2.6.24.7-77.
>
>
>| From cb79f1998d89821a4dbac47f59a46ee3fbbf3c61 Mon Sep 17 00:00:00 2001
>| From: Al Viro <viro@zeniv.linux.org.uk>
>| Date: Sat, 26 Jan 2008 16:49:44 -0500
>| Subject: [PATCH] dlm: dlm/user.c input validation fixes
>| 
>| a) in device_write(): add sentinel NUL byte, making sure that lspace.name will
>| be NUL-terminated
>| b) in compat_input() be keep it simple about the amounts of data we are copying.
>| 
>| Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
>| Signed-off-by: David Teigland <teigland@redhat.com>
>
>Signed-off-by: Eugene Teo <eteo@redhat.com>
>
>---
>diff -uprN linux-2.6.24.7.noarch.default/fs/dlm/user.c linux-2.6.24.7.noarch/fs/dlm/user.c
>--- linux-2.6.24.7.noarch.default/fs/dlm/user.c	2008-01-24 17:58:37.000000000 -0500
>+++ linux-2.6.24.7.noarch/fs/dlm/user.c	2008-08-12 23:22:31.316909000 -0400
>@@ -82,7 +82,8 @@ struct dlm_lock_result32 {
> };
> 
> static void compat_input(struct dlm_write_request *kb,
>-			 struct dlm_write_request32 *kb32)
>+			 struct dlm_write_request32 *kb32,
>+			 size_t count)
> {
> 	kb->version[0] = kb32->version[0];
> 	kb->version[1] = kb32->version[1];
>@@ -94,7 +95,8 @@ static void compat_input(struct dlm_writ
> 	    kb->cmd == DLM_USER_REMOVE_LOCKSPACE) {
> 		kb->i.lspace.flags = kb32->i.lspace.flags;
> 		kb->i.lspace.minor = kb32->i.lspace.minor;
>-		strcpy(kb->i.lspace.name, kb32->i.lspace.name);
>+		memcpy(kb->i.lspace.name, kb32->i.lspace.name, count -
>+			offsetof(struct dlm_write_request32, i.lspace.name));
> 	} else if (kb->cmd == DLM_USER_PURGE) {
> 		kb->i.purge.nodeid = kb32->i.purge.nodeid;
> 		kb->i.purge.pid = kb32->i.purge.pid;
>@@ -112,7 +114,8 @@ static void compat_input(struct dlm_writ
> 		kb->i.lock.bastaddr = (void *)(long)kb32->i.lock.bastaddr;
> 		kb->i.lock.lksb = (void *)(long)kb32->i.lock.lksb;
> 		memcpy(kb->i.lock.lvb, kb32->i.lock.lvb, DLM_USER_LVB_LEN);
>-		memcpy(kb->i.lock.name, kb32->i.lock.name, kb->i.lock.namelen);
>+		memcpy(kb->i.lock.name, kb32->i.lock.name, count -
>+			offsetof(struct dlm_write_request32, i.lock.name));
> 	}
> }
> 
>@@ -504,7 +507,7 @@ static ssize_t device_write(struct file 
> #endif
> 		return -EINVAL;
> 
>-	kbuf = kmalloc(count, GFP_KERNEL);
>+	kbuf = kmalloc(count + 1, GFP_KERNEL);
> 	if (!kbuf)
> 		return -ENOMEM;
> 
>@@ -522,14 +525,14 @@ static ssize_t device_write(struct file 
> 	if (!kbuf->is64bit) {
> 		struct dlm_write_request32 *k32buf;
> 		k32buf = (struct dlm_write_request32 *)kbuf;
>-		kbuf = kmalloc(count + (sizeof(struct dlm_write_request) -
>+		kbuf = kmalloc(count + 1 + (sizeof(struct dlm_write_request) -
> 			       sizeof(struct dlm_write_request32)), GFP_KERNEL);
> 		if (!kbuf)
> 			return -ENOMEM;
> 
> 		if (proc)
> 			set_bit(DLM_PROC_FLAGS_COMPAT, &proc->flags);
>-		compat_input(kbuf, k32buf);
>+		compat_input(kbuf, k32buf, count + 1);
> 		kfree(k32buf);
> 	}
> #endif

Actions: View | Diff

Attachments on bug 458758: 314043 | 314237