linux-kernel - Re: [RESEND PATCH 4/8] mfd: cros_ec: Use a zero-length array for command data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 05 May 2015 17:57:18 +0200
From:	Javier Martinez Canillas <javier.martinez@...labora.co.uk>
To:	Gwendal Grignou <gwendal@...omium.org>
CC:	Olof Johansson <olof@...om.net>, Lee Jones <lee.jones@...aro.org>,
	Doug Anderson <dianders@...omium.org>,
	Bill Richardson <wfrichar@...omium.org>,
	Simon Glass <sjg@...gle.com>,
	Stephen Barber <smbarber@...omium.org>,
	Filipe Brandenburger <filbranden@...gle.com>,
	Todd Broch <tbroch@...omium.org>,
	linux-samsung-soc@...r.kernel.org,
	Linux Kernel <linux-kernel@...r.kernel.org>
Subject: Re: [RESEND PATCH 4/8] mfd: cros_ec: Use a zero-length array for
 command data

Hello Gwendal,

On 04/24/2015 10:29 PM, Gwendal Grignou wrote:
> On Mon, Apr 6, 2015 at 9:15 AM, Javier Martinez Canillas
> <javier.martinez@...labora.co.uk> wrote:

[snip]

>>
>> @@ -110,17 +115,25 @@ static ssize_t ec_device_read(struct file *filp, char __user *buffer,
>>  static long ec_device_ioctl_xcmd(struct cros_ec_device *ec, void __user *arg)
>>  {
>>         long ret;
>> -       struct cros_ec_command s_cmd = { };
>> +       int len;
>> +       struct cros_ec_command *u_cmd = arg;
>> +       struct cros_ec_command *s_cmd;
>> +
>> +       len = max(u_cmd->outsize, u_cmd->insize);
> It does not work, u_cmd is not accessible yet. You should do:
> struct cros_ec_command u_cmd;
> if (copy_from_user(&u_cmd, arg, sizeof(u_cmd)))
>   return -EFAULT;
> len = max(u_cmd.outsize, u_cmd.insize);
> 
>

Right, I'll change that.
 
>> +
>> +       s_cmd = kzalloc(sizeof(*s_cmd) + len, GFP_KERNEL);
>> +       if (!s_cmd)
>> +               return -ENOMEM;
>>
>> -       if (copy_from_user(&s_cmd, arg, sizeof(s_cmd)))
>> +       if (copy_from_user(s_cmd, arg, sizeof(*s_cmd) + len))
> sizeof(*s_cmd) + u_cmd.outsize is good enough.

Ok.

>>                 return -EFAULT;
>>
>> -       ret = cros_ec_cmd_xfer(ec, &s_cmd);
>> +       ret = cros_ec_cmd_xfer(ec, s_cmd);
>>         /* Only copy data to userland if data was received. */
>>         if (ret < 0)
>>                 return ret;
>>
>> -       if (copy_to_user(arg, &s_cmd, sizeof(s_cmd)))
>> +       if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + len))
> sizeof(*s_cmd) + min(ret, u_cmd.insize) is safer

Sure.

>>                 return -EFAULT;
>>
>>         return 0;
> I missed this one earlier. Tools expect the number of byte read, so it should be
> return ret;
> 

Ok, I'll change that as well.

Thanks a lot for your feedback!

Best regards,
Javier
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/