lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 26 Sep 2009 20:50:49 +0200 From: Arjan van de Ven <arjan@...radead.org> To: Arjan van de Ven <arjan@...radead.org> Cc: linux-kernel@...r.kernel.org, torvalds@...ux-foundation.org, mingo@...e.hu Subject: [PATCH 2/9] Simplify bound checks in nvram for copy_from_user From: Arjan van de Ven <arjan@...ux.intel.com> Subject: [PATCH 2/9] Simplify bound checks in nvram for copy_from_user The nvram driver's write() function has an interesting bound check. Not only does it use the always-hard-to-read ? C operator, it also has a magic "i" in there, which comes from the file position of the file. On first sight the check looks sane, however the value of "i" is not checked at all and I as human don't know if the C type rules guarantee that the result is always within bounds.. and neither does gcc seem to know. This patch simplifies the checks and guarantees that the copy will not overflow the destination buffer. Signed-off-by: Arjan van de Ven <arjan@...ux.intel.com> diff --git a/drivers/char/nvram.c b/drivers/char/nvram.c index 88cee40..b2a7eaf 100644 --- a/drivers/char/nvram.c +++ b/drivers/char/nvram.c @@ -267,7 +267,15 @@ static ssize_t nvram_write(struct file *file, const char __user *buf, unsigned char *tmp; int len; - len = (NVRAM_BYTES - i) < count ? (NVRAM_BYTES - i) : count; + len = count; + if (count > NVRAM_BYTES - i) + len = NVRAM_BYTES - i; + + if (len > NVRAM_BYTES) + len = NVRAM_BYTES; + if (len < 0) + return -EINVAL; + if (copy_from_user(contents, buf, len)) return -EFAULT; -- Arjan van de Ven Intel Open Source Technology Centre For development, discussion and tips for power savings, visit http://www.lesswatts.org -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists