lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 28 Apr 2017 18:53:32 -0700 From: Joe Perches <joe@...ches.com> To: Geliang Tang <geliangtang@...il.com>, Ian Abbott <abbotti@....co.uk>, H Hartley Sweeten <hsweeten@...ionengravers.com>, Greg Kroah-Hartman <gregkh@...uxfoundation.org>, Arnd Bergmann <arnd@...db.de> Cc: devel@...verdev.osuosl.org, linux-kernel@...r.kernel.org Subject: Re: [PATCH] staging: comedi: use memdup_user On Sat, 2017-04-29 at 09:45 +0800, Geliang Tang wrote: > Use memdup_user() helper instead of open-coding to simplify the code. While I doubt this is a problem, this loses the multiplication overflow check for sizeof(*insns) * insnlist.n_isns > diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c [] > @@ -1450,22 +1450,14 @@ static int do_insnlist_ioctl(struct comedi_device *dev, > return -EFAULT; > > data = kmalloc_array(MAX_SAMPLES, sizeof(unsigned int), GFP_KERNEL); > - if (!data) { > - ret = -ENOMEM; > - goto error; > - } > - > - insns = kcalloc(insnlist.n_insns, sizeof(*insns), GFP_KERNEL); > - if (!insns) { > - ret = -ENOMEM; > - goto error; > - } > + if (!data) > + return -ENOMEM; > > - if (copy_from_user(insns, insnlist.insns, > - sizeof(*insns) * insnlist.n_insns)) { > - dev_dbg(dev->class_dev, "copy_from_user failed\n"); > - ret = -EFAULT; > - goto error; > + insns = memdup_user(insnlist.insns, sizeof(*insns) * insnlist.n_insns); > + if (IS_ERR(insns)) { > + dev_dbg(dev->class_dev, "memdup_user failed\n"); > + kfree(data); > + return PTR_ERR(insns); > } > > for (i = 0; i < insnlist.n_insns; i++) {
Powered by blists - more mailing lists